PT-2026-66613

Name of the Vulnerable Software and Affected Versions ansible-collection-redhat-leapp affected versions not specified Description A flaw exists where an attacker with privileged write access to a managed node's Leapp report content can manipulate the data. When an operator executes a specific...

PT-2026-66487

Name of the Vulnerable Software and Affected Versions IBM App Connect Enterprise versions 13.0.1.0 through 13.0.7.2 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.27 Description A remote attacker can perform directory traversal on the system. By sending a specially crafted URL reque...

PT-2026-66544

Name of the Vulnerable Software and Affected Versions Leantime version 3.6.2 Description An authenticated attacker can perform server-side request forgery SSRF and local file inclusion LFI by providing unsanitized filenames to the file get contents function within the Blueprints::import method...

PT-2026-66600

Name of the Vulnerable Software and Affected Versions Wolf CMS versions prior to 0.8.3.2 Description An issue in the FileManagerController allows authenticated attackers with the file manager mkfile capability to achieve remote code execution. This is possible due to missing file extension...

vim security update

8.2.2637-26.0.1.el98.13 - Remove upstream references Orabug: 31197557 2:8.2.2637-26.13 - RHEL-203985 CVE-2026-59858 vim: arbitrary Ex command execution in C omni-completion - RHEL-201197 CVE-2026-59856 vim: potential command execution in PHP omni-completion 2:8.2.2637-26.12 - RHEL-191367...

PT-2026-66561

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description Remote Code Execution is possible when loading model weights from a HuggingFace repository. The issue occurs at the '/update weights from disk' endpoint, where a fallback to torch.load...,...

PT-2026-66629

Name of the Vulnerable Software and Affected Versions SFTPGo versions prior to 2.7.4 Description Authenticated users can bypass per-directory access controls by creating symbolic links in a permitted directory that point to files in restricted directories where download, upload, or overwrite...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Link.filename path handling in pip.internal.models.link and the download path joins in pip.internal.network.download and pip.internal.req.reqinstall. An attacker can place files at arbitrary locations on disk...

CVE-2026-54249

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.65.0 through 1.105.0, and 2.0.0b1 through 2.0.0b5, a client that submits message history to a Pydantic AI UI adapter such as the Vercel AI adapter can reference arbitrary files in the application's...

CVE-2026-13268 G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target...

perl-Archive-Tar security update

An update is available for perl-Archive-Tar. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Archive::Tar provides an object oriented mechanism for handling tar...

EUVD-2026-50423

A vulnerability in the zipx.Unzip extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical e.g.,...

CVE-2026-52791

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-52791 fuse-overlayfs release-1.x preserves SUID/SGID bits after truncate/open(O_TRUNC)

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

EUVD-2026-50403

fuse-overlayfs is an implementation of overlayfs in FUSE for rootless containers. Prior to 1.17, the release-1.x C branch preserves SUID and SGID mode bits in main.c during openOTRUNC and truncate handling on a copied-up file, allowing a low-privileged process to leave the upper-layer file with...

CVE-2026-54078 veraPDF Validation XXE via Rich Text

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...

python: Python Tarfile: Unexpected file ownership when extracting hardlinks

A flaw was found in the Python Tarfile.extract function. This vulnerability occurs when processing untrusted tar files containing hardlinks, as the filter parameter is not correctly enforced. An attacker could exploit this to write files with unintended user or group ownership, potentially leadin...