CLEANSTART-2026-OU13146 tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory

Security vulnerability affects the openbao package. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory...

Linux Distros Unpatched Vulnerability : CVE-2026-118773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB, GlobUtil.walkCB2,...

CVE-2026-63190 FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS

FearlessCMS is a flat-file content management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under admin/ perform privileged operations without isLoggedIn authentication checks, CSRF protection or adequate path validation. On PHP's built-in...

CVE-2026-63190

FearlessCMS versions prior to 0.1.4 contain five unauthenticated debug/test PHP scripts under the admin/ directory. On PHP's built-in development server (including default Docker deployments), an authentication bypass exists because router.php fails to normalize URI prefixes, allowing /./admin/ t...

Important: docker

Issue Overview: The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory. A crafted archive can create or overwrite files outside the intended destination. CVE-2026-171...

PT-2026-122737

Security vulnerability affects the openbao package. The tar extraction routines in moby/go-archive Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers do not confine filesystem operations to the destination directory...

Malicious code in node-env-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...

CVE-2026-98045

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. Certain stack retrieval helper functions can perform blocking filesystem operations, but were not properly marked as sleepable. A local user with permission to load BPF programs could exploit this flaw by invoking these...

BIT-NIFI-2026-87976 Apache NiFi Registry: Improper Limitation of Pathname in Persisted Extension Bundles

Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provider used coordinates as filesystem path components without rejected...

PT-2026-96052

Name of the Vulnerable Software and Affected Versions CRI-O affected versions not specified Description An issue exists in the container checkpoint and restore feature where insufficient validation of restore metadata can allow a user with sufficient privileges to perform unintended operations on...

Improper Privilege Management

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Privilege Management in the require process. An attacker can gain unauthorized access to restricted filesystem operations by...

PT-2026-93941

Name of the Vulnerable Software and Affected Versions Apache NiFi Registry versions 0.4.0 through 2.11.0 Description An issue exists during the storage of extension bundle content when using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provide...

CVE-2026-86118

gonic versions before 0.22.0 (a self-hosted media server by sentriz) contain a missing privilege check in the startScan endpoint of its Subsonic API. Because administrator privileges are not validated, any authenticated user can trigger a full media library rescan. An attacker can repeatedly invo...

CVE-2026-86118

gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library rescans. Attackers can repeatedly call the startScan endpoint to force CPU and I/O-intensive filesystem operations, causing denial of service ...

Security update for apptainer

This update for apptainer fixes the following issue: CVE-2026-17106: github.com/moby/go-archive: tar extraction routines do not confine filesystem operations to the destination directory and allow for arbitrary file writes bsc1275248. Patch Instructions: To install this SUSE update use the SUSE...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-55609

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the exportstate and importstate tools in src/consciousness-explorer/mcp/server.js pass the...

PT-2026-81473

sublinear-time-solver is a Rust and WebAssembly library for solving asymmetric diagonally dominant systems in sublinear time. Prior to consciousness-explorer 1.1.2 and sublinear-time-solver 1.6.0, the export state and import state tools in src/consciousness-explorer/mcp/server.js pass the...

CVE-2026-64679

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From 0.19.8 until 0.45.0, Atlantis does not consistently validate user-controlled workspace values supplied through accepted repository-level atlantis.yaml configuration or authenticated...

CVE-2026-64679

Atlantis , a self-hosted Go application that processes Terraform pull request events via webhooks, is affected by a path traversal vulnerability in its workspace handling. From version 0.19.8 through 0.44.x , user-controlled workspace values supplied via repository-level atlantis.yaml configurati...