PT-2026-105843

Summary The upload attachment method in confluence/attachments.py reads and uploads arbitrary local files to Confluence without calling validate safe path. Both download methods download attachment at line 223, download content attachments at line 272 correctly call validate safe path before...

PT-2026-103952

Name of the Vulnerable Software and Affected Versions Tapo C120 v1 Tapo C200 V5 Description Insufficient protection of login challenge data and lack of sanitization of attacker-controlled input processed by the MacTool handler allow an unauthenticated attacker on the same local network to replay...

PT-2026-105089

Exposure of sensitive information to an unauthorized actor in .NET allows an authorized attacker to elevate privileges locally...

PT-2026-103733

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

CVE-2024-58388: Improper Limitation of a Pathname to a Restricted Directory

Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...

CVE-2026-79899: Insecure Temporary File

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2026-78577: Missing Authentication for Critical Function

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs,...

CVE-2026-102369: Improper Authentication

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-9032: NULL Pointer Dereference

Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations...

CVE-2026-12542: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not...

CVE-2026-103431: Improper Neutralization of Escape, Meta, or Control Sequences

colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances before displaying it, allowing a local user on a monitored host to inject escape sequences into the terminal of an operator running colmux, via a crafted proce...

Microsoft Windows dxgkrnl Time-Of-Check Time-Of-Use Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the dxgkrnl.sys...

Critical: amazon-ssm-agent

Issue Overview: Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello. CVE-2026-42505 go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2...

CVE-2026-96577: Missing Authentication for Critical Function

A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent network can connect to the exposed servi...

CVE-2026-13043: Missing Authentication for Critical Function

A missing authentication vulnerability in the Kernel Memory Access Driver PSKMAD used by WatchGuard endpoint security products allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands to the driver, resulting in disclosure of...

PUB-A-508717360

In ispdallowed of gemmsg.c, there is a possible missing authorization due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-103290: Path Traversal: '.../...//'

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...

PT-2026-103822

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.x Description The ImageSize service contains a path traversal issue where insufficient input validation of user-supplied file paths allows authenticated staff users to access local files located outside the...

AlmaLinux 9.6 [TuxCare] Security Update: libtiff / libtiff-devel / libtiff-static / libtiff-tools (ALMALINUX9.6:CLSA-2025:1764886460)

The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2025:1764886460 advisory. - A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file...

Rocky Linux 10.2 [CIQ] Security Update: mrtg / mrtg-debuginfo / mrtg-debugsource / mrtg-selinux (crlsa-2026_57596)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202657596 advisory. mrtg: MRTG daemon symlink-following chown allows local privilege escalation via PID file path manipulation CVE-2026-72694 Tenable has extracted the preceding...