CVE-2026-66007 Datasets Path Traversal via Unsanitized file_name Metadata

Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulnerability in folder-based dataset builders where the filename metadata field is not properly validated before being joined to the dataset directory. Attackers can supply crafted filename values with directory traversal...

CVE-2026-16802

Devolutions PowerShell Universal versions 2026.2.2 and earlier (prior to 2026.2.3) are vulnerable to cleartext storage of sensitive information within the variables feature . If no vault is selected, secret variables are stored in cleartext on disk , allowing a local actor with file system access...

EUVD-2026-48609

Cleartext storage of sensitive information in the variables feature in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local actor with file system access to read secret values via secret variables stored in cleartext on disk when no vault is selected...

SUSE SLES12 Security Update : multipath-tools (SUSE-SU-2026:3212-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2026:3212-1 advisory. This update for multipath-tools fixes the following issues Update to version 0.7.9+238+suse.1249506. - kpartx: integer overflow in the GPT partition...

Security Bulletin: Unauthenticated File Upload Vulnerability Allows Disk Space Exhaustion and Path Disclosure in Langflow OSS

Summary Unauthenticated users can upload unlimited files to the Langflow OSS server via the deprecated /api/v1/upload/flowid endpoint without authentication or validation, leading to potential disk space exhaustion DoS and information disclosure through absolute file path leakage in API responses...

EUVD-2026-42893

n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads...

n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs,...

NPM: n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

NPM: n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads vulnerability discovered by ? in WordPress Npm n8n versions 1.123.58...

GHSA-W867-JM58-P9PV n8n: Authenticated Users Can Exhaust Temporary Disk Storage via Data-Table File Uploads

Impact An authenticated user can repeatedly upload files to the data-table upload endpoint, bypassing the per-request quota check, which does not account for files already written to the shared temporary directory. This causes temporary files to accumulate on disk until the periodic cleanup runs,...

GHSA-HRXH-6V49-42GF vulnerabilities

Vulnerabilities for packages: traefik, task, velero-plugin-for-aws, grafana, tetragon, terraform-provider-pagerduty, cadvisor, crossplane-provider-aws-firehose, newrelic-infrastructure-agent, azurefile-csi, tkn, spqr, k8sgpt, manifest-tool, fulcio, datadog-agent, volume-modifier-for-k8s,...

EUVD-2026-46253

A flaw was found in dracut. A remote attacker on the adjacent network can exploit this vulnerability by providing specially crafted DHCP options, such as a malicious root-path, next-server, or bootfile name, to a system using dracut's NetworkManager-based initrd network module. These options are...

CVE-2026-53369

A flaw was found in the Linux kernel's Universal Disk Format UDF filesystem. A remote attacker could craft a malicious UDF image with an oversized Cyclic Redundancy Check CRC length. This could allow the attacker to bypass the integrity validation of UDF descriptors, leading to the acceptance of...

kubevirt1.8-container-disk-1.8.4-2.1 on GA media (moderate)

kubevirt1.8-container-disk-1.8.4-2.1 on GA media Announcement ID: openSUSE-SU-2026:11314-1 Rating: moderate Cross-References: CVE-2026-27136 CVE-2026-33814 CVE-2026-39821 CVE-2026-39827 CVE-2026-39828 CVE-2026-39832 CVE-2026-42508 CVSS scores: CVE-2026-27136 SUSE : 6.1...

node-tar: Decompression/parse DoS via unlimited input

Summary A Decompression/parse DoS via unlimited input vulnerability in node-tar allows an attacker to exhaust server resources disk space and CPU. Because the library does not enforce hard upper bounds on total decompressed data or entry counts, a small, maliciously crafted "Gzip Bomb" can be use...

Linux Distros Unpatched Vulnerability : CVE-2026-53369

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted U...

PT-2026-62017

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-2.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11314-1 kubevirt1.8-container-disk-1.8.4-2.1 on GA media

These are all security issues fixed in the kubevirt1.8-container-disk-1.8.4-2.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2026-53369

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...

CVE-2026-53369

CVE-2026-53369 affects the Linux kernel UDF handling. The vulnerability stems from udf_read_tagged() not rejecting descriptors when descCRCLength + sizeof(struct tag) exceeds the block size, allowing a crafted UDF image to set an oversized CRC length and bypass CRC validation. As a result, a desc...

EUVD-2026-45439

In the Linux kernel, the following vulnerability has been resolved: udf: reject descriptors with oversized CRC length udfreadtagged skips CRC verification when descCRCLength + sizeofstruct tag exceeds the block size. A crafted UDF image can set descCRCLength to an oversized value to bypass CRC...