RLSA-2026:22120 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum validation flaw via malicious module proxy...

RLSA-2026:22121 Important: golang security update

The golang packages provide the Go programming language compiler. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum validation flaw via malicious module proxy...

golang security update

An update is available for golang. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The golang packages provide the Go programming language compiler. Security...

RLSA-2026:22112 Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fixes: net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity bypass due to checksum...

go-toolset:rhel8 security update

An update is available for golang, module.golang, module.delve, delve. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Go Toolset provides the Go programming...

CVE-2026-75413

DocSys V2.02.80 is vulnerable to Any File Download. An attacker does not need to go through authentication to utilize the downloadDocEx.do interface and download any file via the parameter targetPath...

PT-2026-82212

Name of the Vulnerable Software and Affected Versions FiftyOne affected versions not specified Description The application renders a dataset field's description as markup without proper sanitization or escaping. Specifically, the sidebar field-information component located at...

CVE-2026-75331

tamguo 1.5.3 is vulnerable to Unrestricted File Upload Leading to Stored XSS. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java have no file type validation. Attackers can upload arbitrary HTML/JavaScript files to the server...

PT-2026-82044

Name of the Vulnerable Software and Affected Versions TeamViewer Desktop Clients versions prior to 15.81.5 Description Improper neutralization of path traversal sequences allows an authenticated remote session participant to write files to unintended locations on the local file system. This occur...

EUVD-2026-66662

Path traversal vulnerability in UnPoller 2.33.0 password field allows arbitrary file read and network exfiltration...

PT-2026-82356

An attacker who can set the file name header on a message reaching a ZipTransformer with ZipResultType.FILE the default can cause the resulting .zip archive to be written to an arbitrary filesystem path outside the configured workDirectory. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0....

CVE-2025-61165

An arbitrary file upload vulnerability in the /v1/mydrive/batchupload component of cohere North AI v1.1.5 allows attackers to exeute arbitrary code via uploading a crafted file...

CVE-2026-75333

yx-image-recognition v1.0 is vulnerable to Path Traversal. Parameters such as dir, filePath are directly passed to new File for file system operations without any path sanitization or whitelist validation...

PT-2026-82331

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.15.3 Description Stored cross-site scripting occurs when file comments are stored as raw text and rendered into the page using innerHTML without sanitization. The backend only performs a length check, allowing a team...

CVE-2026-36851

UnPoller v2.33.0 contains a path traversal vulnerability in its password field. In pkg/inputunifi/input.go, any value prefixed with file:// is passed to os.ReadFile() without path validation, allowing an attacker with write access to the up.conf file to specify any readable file on the system. Th...

CVE-2026-75327

DocSys-master V2.02.85 contains an arbitrary file upload vulnerability in the uploadMarkdownPic interface located at src/com/DocSystem/controller/DocController.java. The flaw is remotely exploitable with low complexity , requires no privileges or user interaction, and carries a CVSS 3.1 score of ...

VulnCheck KEV: CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

PT-2026-81967

The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.3 does not sanitize a user-supplied image reference before using it as the source of a file move, allowing users with a subscriber-level account to relocate arbitrary server-readable image files...

CVE-2026-75333

yx-image-recognition v1.0 contains a Path Traversal vulnerability where parameters such as dir and filePath are passed directly to new File() for file system operations without any path sanitization or whitelist validation. The CVSS 3.1 score is 7.5 (High) , reflecting a network vector with no pr...

Linux Distros Unpatched Vulnerability : CVE-2026-79151

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted...