CVE-2026-68491

An insufficient check allowed for the overwrite of arbitrary files via a symlink...

CVE-2026-54337 Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue...

EUVD-2026-79946

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue...

CVE-2026-54337 Fireshare has Unauthenticated Argument Injection to Arbitrary File Write/Overwrite

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue...

CVE-2026-54337

Fireshare is a self-hosted media and link sharing application. Prior to version 1.6.14 , an argument injection in the video upload function allows an unauthenticated remote attacker to write or overwrite system files, resulting in high impact on confidentiality, integrity, and availability (CVSS ...

CVE-2026-25825

An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user with admin access the possibility to write files in arbitrary directories i...

USN-8763-1: kitty vulnerabilities

It was discovered that kitty incorrectly escaped error messages when handling specially crafted terminal escape sequences. A remote attacker could possibly use this issue to execute arbitrary commands. CVE-2026-42850 It was discovered that kitty incorrectly handled remote edit requests in termina...

USN-8763-1 kitty vulnerabilities

It was discovered that kitty incorrectly escaped error messages when handling specially crafted terminal escape sequences. A remote attacker could possibly use this issue to execute arbitrary commands. CVE-2026-42850 It was discovered that kitty incorrectly handled remote edit requests in termina...

PT-2026-93174

CVE-2026-68491 An insufficient check allowed for the overwrite of arbitrary files via a symlink. https://t.co/CZ9pLnixMr...

PT-2026-93113

Fireshare facilitates self-hosted media and link sharing. Prior to version 1.6.14, an argument Injection in the video upload function allows unauthenticated attacker to write/overwrite system files. Version 1.6.14 fixes the issue...

MiracleLinux 8 : gzip-1.9-15.el8_10 (AXSA:2026-1832:03)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1832:03 advisory. gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility CVE-2026-41991 gzip: gzip: Information disclosure via...

EUVD-2026-78627

An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set to any path, even one that points to a file that already exists. This gives a user with admin access the possibility to write files in arbitrary directories i...

PT-2026-92026

Name of the Vulnerable Software and Affected Versions Keyfactor SignServer versions prior to 7.6.0 Description An issue exists where the output file used by the SignerStatusReportWorker for logging reports can be configured to any path, including those of existing files. This allows a user with...

CVE-2026-68491: Improper Link Resolution Before File Access

An insufficient check allowed for the overwrite of arbitrary files via a symlink...

EUVD-2026-77809

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets. A remote attacker can select any path writable by the Anyquery server proces...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

rsync: rsync: Local Privilege Escalation via Symlink Following

A symlink-following vulnerability in rsync allows local attackers to redirect predictable output paths to arbitrary filesystem locations. When rsync runs with elevated privileges such as setuid or a privileged daemon, this enables arbitrary file overwrites and local privilege escalation...

Updated tar packages fix security vulnerabilities

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. CVE-2025-45582 Tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape. CVE-2026-18477 Tar: --one-top-level hardlink targets not confined to...

MGASA-2026-0401 Updated tar packages fix security vulnerabilities

GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. CVE-2025-45582 Tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape. CVE-2026-18477 Tar: --one-top-level hardlink targets not confined to...

CVE-2026-57145

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, symlink resolution, a workspace boundary, or protected-path checks...