Linux Distros Unpatched Vulnerability : CVE-2026-72219

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lockd: Plug nlmfile leak when nlmdofopen fails A client can repeatedly drive nlmdofopen failures by presenting file handles that the underlying export rejects...

Linux Distros Unpatched Vulnerability : CVE-2026-74315

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: lockd: Avoid hashing uninitialized bytes in nlm4svclookupfile filehash digests the first...

EUVD-2026-61097

A directory traversal vulnerability in reportico-web = 8.1.0 allows remote attackers to expose or execute arbitrary php files on the web server by specifying the filename in the targetformat parameter in conjunction with the executemode=EXECUTE parameter of the run.php endpoint...

PT-2026-77191

Joomla! Core - 20260801 - Response header injection in download views in Joomla 3.0.0-5.4.7, 6.0.0-6.1.2 - Lack of output processing allowed a header injection in the multiple download views, leading to reflected file download / content-type confusion...

PT-2026-77386

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Payments versions 12.2.3 through 12.2.15 Description A flaw in the File Transmission component allows a low privileged attacker with network access via HTTP to compromise the system. This can lead to unauthorized...

PT-2026-77243

MobSF is a mobile application security testing tool used. Prior to 4.5.1, find icon path zip in mobsf/StaticAnalyzer/views/android/icon analysis.py uses the Android manifest android:icon value to construct paths under the scan resource directory without rejecting traversal or verifying containmen...

PT-2026-78232

Name of the Vulnerable Software and Affected Versions Confidential Containers Guest Components versions 0.16.0 through 0.19.0 Description A crafted OCI image layer can cause the image rs::stream::unpack::unpack function to create a hardlink outside its intended destination directory. This occurs...

PT-2026-77041

Contributor Arbitrary File Upload in Sync Post With Other Site = 1.9.3 versions...

PT-2026-77154

Vim is an open source, command line text editor. Prior to 9.2.0845, StructMembers in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection followed by a command...

VulnCheck KEV: CVE-2026-73400

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress = 2.4.11 versions...

PT-2026-77387

Name of the Vulnerable Software and Affected Versions Oracle Payments versions 12.2.3 through 12.2.15 Description An issue exists in the File Transmission component of Oracle Payments within Oracle E-Business Suite. An unauthenticated attacker with network access via HTTP can exploit this flaw to...

PT-2026-77165

Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.64 Description The image analyze tool fails to canonicalize symlinks before reading files, leading to a path traversal issue. This allows attackers to create workspace symlinks that point to external files with...

PT-2026-77251

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.0.0 through 4.14.5 Description An issue exists where authenticated cluster peers can delete arbitrary directory contents within the installation path writable by the wazuh user. This occurs because the system fails to validate...

PT-2026-77163

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter. Attackers can supply rev values like --contents=/path/to/file to exfiltrate sensitive files...

PT-2026-78235

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.5.0 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The downloadSubtitleFile function in src/ipc/downloads.js, accessed via the run-download IPC...

PT-2026-77142

Oh My Zsh is a community-driven framework for managing Zsh configuration. Prior to 2026-05-28, the dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH DOTENV FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the...

Linux Distros Unpatched Vulnerability : CVE-2026-73646

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18,...

gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

Multiple integer overflow and underflow vulnerabilities were found in the GStreamer gst-plugins-ugly ASF demuxer asfdemux when parsing header objects from crafted ASF, WMV, or WMA files. Insufficient validation of attacker-controlled length and size values can bypass bounds checks and cause...

CVE-2026-42162

Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...