CVE-2026-53785

rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The makepath function follows symlinks pointing outside the destination...

GHSA-XXM9-W59Q-M66X Duplicate Advisory: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hf8h-97gm-4x2p. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows...

CVE-2026-73605

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on t...

UBUNTU-CVE-2026-73619

GitPython before 3.1.57 contains an incomplete denylist in the unsafegitarchiveoptions guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive to read arbitrary files from the filesystem and include them in the returned archive...

CVE-2026-73605

SiYuan before v3.7.4 has a path traversal vulnerability in the getUniqueFilename endpoint that lets anonymous readers probe filesystem existence by supplying absolute paths. The issue enables reconnaissance of the host’s filesystem layout and installed software without validation or confinement. ...

CVE-2026-73605 SiYuan before v3.7.4 Path Traversal via getUniqueFilename

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on t...

CVE-2026-73605 SiYuan before v3.7.4 Path Traversal via getUniqueFilename

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on t...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files

A flaw in FreeRDP's file parser incorrectly treats lines starting with a forward slash / as command-line options. If a victim opens a maliciously crafted .rdp file, an attacker can silently inject CLI flags to execute arbitrary code, expose local filesystems, or bypass certificate validation...

RLSA-2026:54247 Moderate: kernel-rt security update

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fixes: kernel: udf: fix partition descriptor append bookkeeping CVE-2026-45991 kernel: ice: fix double-free of txbuf skb CVE-2026-53009 For more...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

PT-2026-71433

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A path traversal issue exists in the 'getUniqueFilename' endpoint. This allows anonymous readers to probe the filesystem without validation or confinement by supplying arbitrary absolute paths. This c...

PT-2026-105555

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hf8h-97gm-4x2p. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows...

CVE-2026-48099: Improper Limitation of a Pathname to a Restricted Directory

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4...

CVE-2026-73605: Missing Authorization

SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute paths to determine whether files and directories exist on t...

AlmaLinux 8 : kernel-rt (ALSA-2026:54247)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54247 advisory. kernel: udf: fix partition descriptor append bookkeeping CVE-2026-45991 kernel: ice: fix double-free of txbuf skb CVE-2026-53009 Tenable has extracted th...

GHSA-72XP-24P9-7VPF Duplicate Advisory: Absolute filesystem path and OS username disclosure via resolveAssetPath

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-jv8v-xq2h-657v. This link is maintained to preserve external references. Original Description SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the resolveAssetPath endpoint that...

CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-63293

A link following vulnerability in LXD allows an attacker to achieve arbitrary file read and write operations on the host system. When importing or unpacking an image archive, LXD fails to validate whether the metadata.yaml file is a symbolic link. An attacker can exploit this flaw by providing a...

CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...