CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

DEBIAN-CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

UBUNTU-CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-74859 Gnome-tweaks: path traversal in theme installer

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

EUVD-2026-72673

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-74859

gnome-tweaks contains a path traversal vulnerability in its shell theme installer. The installer extracts user-supplied ZIP archives without validating archive member paths, allowing a crafted theme archive to write files outside ~/.themes via ../ sequences, absolute paths, or symlink entries. Th...

CVE-2026-74859 Gnome-tweaks: path traversal in theme installer

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-74859

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

PT-2026-87203

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A use-after-free condition occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue where an...

PT-2026-87971

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-74859: Improper Limitation of a Pathname to a Restricted Directory

The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can write files outside /.themes by using ../ path traversal, absolute paths, or symlink entries...

CVE-2026-54611: Improper Control of Generation of Code

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...

CVE-2026-62694: Use After Free

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally...

Linux Distros Unpatched Vulnerability : CVE-2026-74859

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafted theme archive can...

PT-2026-87831

Name of the Vulnerable Software and Affected Versions Windows Installer affected versions not specified Description A heap-based buffer overflow occurs in Windows Installer, which allows an authorized attacker to elevate privileges locally. A heap-based buffer overflow is a memory corruption issu...

CVE-2026-77894: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-69441: Concurrent Execution using Shared Resource with Improper Synchronization

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2026-71339: Heap-based Buffer Overflow

Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally...

PT-2026-87192

InstantCMS is a free and open source content management system. Versions prior to 2.18.2 have a Remote Code Execution RCE issue that allows remote authenticated attackers to execute any PHP code via the component installer. It is possible to upload a malicious component into the server, however, ...