Apache Camel 4.22.0 SMB Consumer Path Traversal

Apache Camel versions from 4.2.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal vulnerability in the SMB consumer that could allow a crafted share listing entry to access, delete, or rename files outside the polled directory...

Apache Camel FTP 4.22.0 Path Traversal

Apache Camel FTP versions from 4.0.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal vulnerability. This proof of concept uses a malicious directory listing to demonstrate access to a file outside the configured polling directory. https://packetstorm.news/download/236116...

Apache Camel 4.22.0 SFTP Consumer Path Traversal

Apache Camel versions from 4.18.0 before 4.18.5 and from 4.19.0 before 4.22.1 contain a path traversal issue in the mina-sftp consumer. A malicious SFTP server can supply crafted directory-entry names that cause the consumer to access files outside its configured polling directory. Included proof...

PT-2026-116382

The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms delete entry attachments function in all versions up to, and including, 1.6.28 This makes it possible for...

PT-2026-116368

Name of the Vulnerable Software and Affected Versions Contact Form 7 Signature Addon versions prior to 4.2.3 Description An issue exists where the plugin fails to sanitize a signature field value used to build an email attachment path. This allows unauthenticated users to perform path traversal—a...

Linux Distros Unpatched Vulnerability : CVE-2026-111458

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The fanxfingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is...

Linux Distros Unpatched Vulnerability : CVE-2026-111802

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying wheth...

Linux Distros Unpatched Vulnerability : CVE-2026-92877

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The JAXB factory methods historically relied solely on FEATURESECUREPROCESSING to prevent XML External Entity XXE resolution. On JAXP implementations where that...

Rocky Linux 8 [CIQ] Security Update: lrzsz / lrzsz-debuginfo / lrzsz-debugsource Multiple Vulnerabilities (crlsa-2026_83525)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202683525 advisory. lrzsz: lrzsz: Arbitrary file overwrite via absolute path traversal in restricted mode CVE-2026-105840 lrzsz: lrzsz: Arbitrary command execution via crafte...

Linux Distros Unpatched Vulnerability : CVE-2026-55543

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-disk archive,...

Linux Distros Unpatched Vulnerability : CVE-2026-62438

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or previe...

PT-2026-116194

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

Apache Camel 4.22.0 Azure Files Path Traversal

Apache Camel version 4.22.0 azure-files consumers can resolve a server-supplied listing name outside the configured directory, permitting retrieval and potentially deletion or rename of files using the endpoint credentials...

CVE-2026-111854: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1792190438)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1792190438 advisory. - A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary locations on the host filesystem via...

Linux Distros Unpatched Vulnerability : CVE-2026-102740

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.16.1 and 3.0.12,...

CVE-2026-104246: Improper Limitation of a Pathname to a Restricted Directory

The Contact Form 7 Signature Addon WordPress plugin through 4.2.2 does not sanitize a signature field value before building an email attachment path from it, allowing unauthenticated users to attach arbitrary files bounded to wp-content on current Contact Form 7 to a form's outgoing email via pat...

Linux Distros Unpatched Vulnerability : CVE-2026-95125

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libming through 0.4.8 contains a heap buffer overflow in rreadc in src/blocks/fromswf.c. A crafted SWF file with a malformed or truncated RECT header can cause ...

CVE-2026-85706

CVE-2026-85706: GitLab CE/EE Unauthenticated Path Traversal CVE : CVE-2026-85706, CVSS 3.1 10.0 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N Component : GitLab CE/EE Repository Commits API Workhorse body-upload variant Affected : 18.7 ≤ version 19.1.8, 19.2.0–19.2.5, 19.3.0–19.3.1 Fixed : 19.1.8 / 19.2.6 ...

SUSE CVE-2026-92390

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...