AlmaLinux 9.2 [TuxCare] Security Update: pki-jackson-databind (ALMALINUX9.2:CLSA-2025:1764858279)

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764858279 advisory. - jackson-core contains core low-level incremental streaming parser and generator abstractions used by Jackson Data Processor. In versions...

AlmaLinux 9.2 [TuxCare] Security Update: gimp / gimp-devel / gimp-devel-tools / gimp-libs (ALMALINUX9.2:CLSA-2025:1758744098)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1758744098 advisory. - A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted ...

Rocky Linux 9.6 [TuxCare] Security Update: openexr / openexr-devel / openexr-libs (ALMALINUX9.6:CLSA-2026:1790781324)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790781324 advisory. - OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versio...

AlmaLinux 9.2 [TuxCare] Security Update: iscsi-initiator-utils / iscsi-initiator-utils-devel / etc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1787396809)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1787396809 advisory. - An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open- iscsi allows remote MITM...

SUSE CVE-2026-97024

A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files such as passwd, group, machine-id, or resolv.conf to be emptied or replaced with a symlink when the app is installed or upgraded...

CVE-2026-86136

The Fireware OS is impacted by a missing authorization vulnerability in the wgagent management daemon 's session initialization function. An authenticated, low-privileged user, such as a guest administrator or read-only account, can submit a specially crafted management API request to crash the w...

CVE-2026-86136 Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A

A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user including a read-only or guest administrator account to crash the wgagent process and read arbitrary files accessible to the daemon by submitting a...

CVE-2026-102904

A flaw was found in JupyterLab. When processing extension uninstallation requests, user-supplied package names are passed to the underlying package manager without properly filtering command-line options. An authenticated user with extension management access can exploit this argument injection...

CVE-2026-70356

The Toptech TMS7 and TopHAT systems are vulnerable to an unrestricted file upload flaw in the TMS file upload endpoint . Due to a lack of server-side file type restrictions , an attacker with high privileges can upload and execute arbitrary PHP files on the web server. This vulnerability has a CR...

CVE-2026-70356 Toptech TMS7 and TopHAT Unrestricted Upload of File with Dangerous Type

The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and execute arbitrary PHP files on the web server...

CVE-2026-102904 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

Malicious code in queeuees (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f793adc7f1d26294831307abed18a284d7834d8e4733a8b05d9863bf2d70c60d Queeuees 0.0.1 ships two top-level packages, Queeuees and Queues, with byte-identical init.py files. Each init.py assembles a byte blob from...

CVE-2026-102252

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-102252 Path Traversal in VMDK Extractor in OSV-SCALIBR

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

EUVD-2026-89370

A path traversal vulnerability CWE-22 in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows an attacker who controls the scan target to write arbitrary files to the host system. When scanning crafted VMDK images, insufficient validation of archive pat...

CVE-2026-102252

A path traversal vulnerability (CWE-22) exists in the embedded VMDK filesystem extractor within Google OSV-SCALIBR versions 0.3.6 through 0.5.0 . The root cause is insufficient validation of archive path entries , which enables an attacker controlling the scan target to extract files outside of t...

MGASA-2026-0462 Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...

Updated fuse-overlayfs package fixes security vulnerabilities

fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/openOTRUNC. CVE-2026-52791 Operations on hardlinked lower-layer files resolving to the wrong layer. CVE-2026-77478...

CVE-2026-84414

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validation of an attacker-controlled file path...

CVE-2026-102810

Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attackers to read arbitrary files. The handlerequest function in src/server.rs fails to reject .. segments after percent-decoding and joining the request path to...