PT-2026-84522

Name of the Vulnerable Software and Affected Versions Laravel Excel versions 3.1.8 through 3.1.69 Description The MaatwebsiteExcelFilesDisk::copy function in src/Files/Disk.php resolves the $destination variable, provided via Excel::store, $export-store, or storeExcel, against the process working...

CLSA-2026-1777596494 TuxCare security update for league/flysystem (1 CVE)

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.0.70-p1+tuxcare...

CLSA-2026-1777596493 TuxCare security update for league/flysystem (1 CVE)

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.1.10-p1+tuxcare...

PT-2026-74662

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.0.70-p1+tuxcare...

PT-2026-74661

TuxCare rebuilt league/flysystem to address 1 CVE. Fixed in 1.1.10-p1+tuxcare...

CVE-2026-57856

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

CVE-2026-57856: Improper Limitation of a Pathname to a Restricted Directory

Cockpit CMS contains a path traversal vulnerability in the Bucket file storage API /system/buckets/api. The api method in modules/System/Controller/Buckets.php sanitizes the bucket name with pregreplace'/^a-zA-Z0-9-\./','', $bucket, which permits '..' and '../' sequences. The sanitized value is...

EUVD-2021-1300

Malware in sbrugna...

EUVD-2021-2574

Malware in sbrugna...

EUVD-2022-6920

Malicious code in bioql PyPI...

Linux Distros Unpatched Vulnerability : CVE-2021-32708

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flysystem is an open source file storage library for PHP. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specif...

CVE-2021-36564

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component vendor\league\flysystem-cached-adapter\src\Storage\Adapter.php...

CVE-2021-36567

ThinkPHP v6.0.8 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\AbstractCache...

Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Thephpleague Flysystem

CVE-2021-32708 Affected versions of this package are vulnerabl...

Nextcloud: Suspicious login app ships old league/flysystem version

A vulnerability in the Suspicious Login app allowed a remote attacker to execute arbitrary code on the target system due to a race condition. The vulnerability was caused by an outdated version of the Flysystem library 0.1.0 - 2.1.0 that allowed a malicious user to upload and execute arbitrary co...

ThinkPHP deserialization vulnerability

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

GHSA-QJJJ-7G7H-54V3 ThinkPHP deserialization vulnerability

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2022-38352

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

Deserialization of untrusted data

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload...

CVE-2022-38352

ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload...