CVE-2025-60496

A Floating-Point Exception FPE in the reframersendpacket function /filters/reframer.c of GPAC Project/MP4Box before 2.5 allows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

Apache Paimon 2.1.0 MySQL CDC Arbitrary File Read

Summary A lake format that enables building a Realtime Lakehouse Architecture with Flink and Spark for both streaming and batch operations. Innovatively combines lake format and LSM structure, bringing realtime streaming updates into the lake architecture. Description Apache Paimon's MySQL CDC...

PT-2026-118385

Name of the Vulnerable Software and Affected Versions filelock versions prior to 4.2.1 Description In UnixFileLock, a regular file renamed onto the lock path can be truncated if another local user possesses rename permissions or if the file is hard-linked under a permissive hard-link policy...

PT-2026-118324

UNSUPPORTED WHEN ASSIGNED Improper restriction of recursive entity references in DTDs 'XML entity expansion' vulnerability in Apache Cocoon. This issue affects Apache Cocoon: all versions. XEE in the fp: form processor could lead to SSRF, including exposing files from the server to an untrusted...

PT-2026-118310

The file search of the extension builds its database conditions by wrapping the search term in quotes itself. Only the wildcard characters of the LIKE operator are escaped, quote characters are not. A crafted search term can therefore leave the intended string value and change the database query...

ALSA-2026:86056 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

PT-2026-119173

Vulnerability in Oracle Autonomous Health Framework component: Trace File Analyzer. Supported versions that are affected are 26.3-26.8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Autonomous Health Framework executes to compromise...

CVE-2016-20103: Improper Limitation of a Pathname to a Restricted Directory

Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like...

PT-2026-118338

Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files through the path parameter of /api/system/files/content. Attackers can supply absolute paths to read /etc/shadow, /etc/passwd, git .git/config credentials, an...

PT-2026-118290

A vulnerability could allow an attacker with access to an encrypted project file to retrieve administrator credentials for EdgeLink-enabled devices...

CVE-2014-125133: Improper Limitation of a Pathname to a Restricted Directory

NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve...

PT-2026-118680

Name of the Vulnerable Software and Affected Versions Aspose Importer & Exporter plugin for WordPress versions prior to 3.0 Description A path traversal issue allows unauthenticated attackers to download arbitrary files. This occurs because the file parameter is not properly sanitized. Attackers...

Linux Distros Unpatched Vulnerability : CVE-2026-111066

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can retain an unbounded...

Linux Distros Unpatched Vulnerability : CVE-2026-112405

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge can dereference a null image8 plane. Validation skips the first input band,...

Alibaba Cloud Linux 3 : 0312: gstreamer1-plugins-base (ALINUX3-SA-2026:0312)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0312 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2026-18297: GStreamer OGG File Parsing...

Alibaba Cloud Linux 3 : 0317: tar (ALINUX3-SA-2026:0317)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2026:0317 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-45582: GNU Tar through 1.35 allow...

AlmaLinux 9.2 [TuxCare] Security Update: hplip / hplip-common / hplip-libs / libsane-hpaio Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1792490933)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792490933 advisory. - HP has identified and remediated multiple externally reported vulnerabilities within HPLIP. The findings affect several software...

MariaDB 10.6.0 < 10.6.28/ 10.11.0 < 10.11.19/ 11.4.0 < 11.4.13/ 11.8.0 < 11.8.9/ 12.3.0 < 12.3.3/ 13.0.0 < 13.0.2

The version of MariaDB installed on the remote host is prior to 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, 13.0.2. It is, therefore, affected by a vulnerability as referenced in the GHSA-m5gf-432r-g5jw advisory. - MariaDB server is a community developed fork of MySQL server. From 10.6.1 until...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1791819150)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1791819150 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can replace /.var/app/$appid/.ld.so with a symlink, causing regenerateldcache to write...

Linux Distros Unpatched Vulnerability : CVE-2026-98553

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an...