PYSEC-2026-516 Ray Missing Authorization vulnerability

LFI in Ray's /static/ directory allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers response can be found here:...

PYSEC-2026-529 Salt vulnerable to directory traversal attack in file receiving method

Directory traversal vulnerability in recvfile method allows arbitrary files to be written to the master cache directory...

PYSEC-2026-357 internetarchive Vulnerable to Directory Traversal in File.download()

Impact What kind of vulnerability is it? This is a Critical severity directory traversal path traversal vulnerability in the File.download method of the internetarchive library. Who is impacted? All users of the internetarchive library versions 5.5.1 are impacted. The vulnerability is particularl...

PYSEC-2026-315 Cobbler Improper Validation of Security Tokens

Cobbler version Verified as present in Cobbler versions 2.6.11+, but code inspection suggests at least 2.0.0+ or possibly even older versions may be vulnerable contains a Incorrect Access Control vulnerability in XMLRPC API /cobblerapi that can result in Privilege escalation, data manipulation or...

PYSEC-2026-512 Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend component

The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as demonstrated by /c:/file/ignore...

CVE-2026-47162

A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of...

CVE-2026-57346

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Epiphyt Embed Privacy allows Path Traversal. This issue affects Embed Privacy: from n/a through 1.12.3...

OPENSUSE-SU-2026:21166-1 Security update for nano

This update for nano fixes the following issues: Changes in nano: - Update to version 9.1: When searching, the viewport is placed snug left where possible. The ability to read and write files in old Mac format a lone carriage return as line ending was removed. The ^T toggle between WhereIs and...

Malicious code in rebrandly-domains-digger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4d1744d2a299b9ef0526f49b4b2297fcd6c72581c51a3359801db56318d8cfda The package declares a preinstall hook that runs node callback.js. On npm install, callback.js collects installer-side identifiers — os.hostname,...

Malicious code in rebrandly-domains-search-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d4464320c8530d582d35f85ce95045182d82e1dd63a830644bcb68f05bdf10e Package [email protected] is an empty module index.js exports an empty object whose package.json preinstall hook runs node...

CVE-2026-36848

Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem...

PT-2026-61527

Name of the Vulnerable Software and Affected Versions All-in-One WP Migration and Backup versions prior to 7.106 Description An issue exists where a user-supplied value is not properly sanitized before being used to construct a file path. This allows unauthenticated attackers to create or append ...

PT-2026-53300

Name of the Vulnerable Software and Affected Versions Business Directory versions prior to 6.4.24 Description An unauthenticated broken access control issue exists, allowing unauthorized users to bypass access restrictions. Recommendations Update to a version newer than 6.4.23...

CVE-2026-36848

Gigamon GVOS v5.16.1 and below is vulnerable to Directory Traversal in the GVOS H-VUE subsystem...

CVE-2026-36848

Gigamon GVOS v5.16.1 and earlier is affected by a Directory Traversal in the H-VUE subsystem. The root cause is in the legacy persistd web service (port 8089) of GVOS, where DownloadDbFile and UploadDbFile handlers mishandle user-supplied paths, enabling arbitrary file read/write outside the GVOS...

perl-Archive-Tar security update

2.30-2 - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181654 2.30-1 - 2.30 bump 2.28-1 - 2.28 bump - Fixes CVE-2018-12015 directory traversal bug 1588761 2.26-6 - Do not run optional test on RHEL 2.26-5 - Rebuilt for...

PT-2026-53735

Name of the Vulnerable Software and Affected Versions Matrix42 Empirum versions prior to 25.5 Matrix42 Empirum versions 26.x prior to 26.2 Description The PBackupVSS.exe component creates a named pipe at '.pipePBackupVSS' with a Discretionary Access Control List DACL that grants GENERIC READ and...

PT-2026-53654

Name of the Vulnerable Software and Affected Versions Gigamon GVOS versions prior to 5.16.2 Description The GVOS H-VUE subsystem contains a directory traversal flaw, which allows an attacker to access files and directories outside the intended folder. Recommendations Update Gigamon GVOS to versio...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the getImportedVocabFile function in the tokenVocab Grammar Option Handler. An attacker can access arbitrary files on the system by supplying crafted input paths. Details A Directory Traversal attack also known a...

SUSE CVE-2026-53324

In the Linux kernel, the following vulnerability has been resolved: net: mana: Use pciname for debugfs directory naming Use pcinamepdev for the per-device debugfs directory instead of hardcoded "0" for PFs and pcislotnamepdev-slot for VFs. The previous approach had two issues: 1. pcislotname...