CVE-2026-5038

A flaw was found in multer. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by initiating and then aborting or sending malformed multipart uploads. This action leaves orphaned partial files on the disk, which can lead to the exhaustion of available disk space withou...

CVE-2026-66007

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

CVE-2026-16802

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected...

EUVD-2026-48613

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

CVE-2026-66007 Datasets Path Traversal via Unsanitized file_name Metadata

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

CVE-2026-66007 Datasets Path Traversal via Unsanitized file_name Metadata

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

CVE-2026-66007 Datasets Path Traversal via Unsanitized file_name Metadata

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

CVE-2026-16802

Affected product/versions: Devolutions PowerShell Universal 2026.2.2 and earlier. Vulnerability: Cleartext storage of sensitive information in the variables feature. Impact: Local attacker with file system access can read secret values stored in cleartext on disk when no vault is selected; confid...

EUVD-2026-48609

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected...

Security Bulletin: Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS

Summary Unauthenticated users can upload unlimited files to the Langflow OSS server via the deprecated /api/v1/upload/flowid endpoint without authentication or validation, leading to potential disk space exhaustion DoS and information disclosure through absolute file path leakage in API responses...

EUVD-2026-42893

n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads...

GHSA-W867-JM58-P9PV n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs,...

GHSA-HRXH-6V49-42GF vulnerabilities

Vulnerabilities for packages: fluent-bit-plugin-loki, kubernetes-csi-external-health-monitor, sops, crossplane-provider-aws-cloudformation, amazon-cloudwatch-agent-operator, steampipe, cert-manager-istio-csr, op-geth, crossplane-provider-aws-cloudfront, k3s, ksops, argo-workflows, trivy,...

EUVD-2026-46253

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

CVE-2026-53369

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could craft a malicious UDF image with an oversized Cyclic Redundancy Check CRC length. This could allow the attacker to bypass the integrity validation of UDF descriptors, leading to the acceptance of...

kubevirt1.8-container-disk-1.8.4-2.1 on GA media (moderate)

kubevirt1.8-container-disk-1.8.4-2.1 on GA media Announcement ID: openSUSE-SU-2026:11314-1 Rating: moderate Cross-References: CVE-2026-27136 CVE-2026-33814 CVE-2026-39821 CVE-2026-39827 CVE-2026-39828 CVE-2026-39832 CVE-2026-42508 CVSS scores: CVE-2026-27136 SUSE : 6.1...

node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...

OPENSUSE-SU-2026:11314-1 kubevirt1.8-container-disk-1.8.4-2.1 on GA media

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-2.1 package on the GA media of openSUSE Tumbleweed...

PT-2026-62017

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-2.1 package on the GA media of openSUSE Tumbleweed...

Linux Distros Unpatched Vulnerability : CVE-2026-53369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted U...