CVE-2026-72695

Grav (flat-file CMS) before 2.0.16 is affected by a path traversal vulnerability in MediaUploadTrait::deleteFile(). The method validates only the basename portion of a supplied filename while leaving unvalidated directory paths containing ../ sequences intact, passing the full path to unlink(). T...

CVE-2026-72695 Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

EUVD-2026-65209

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

CVE-2026-72695 Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFile

Grav before 2.0.16 contains a path traversal vulnerability in MediaUploadTrait::deleteFile that allows authenticated users with media management permissions to delete arbitrary files by supplying filenames with directory traversal sequences. The method validates only the basename portion of the...

SUSE CVE-2026-63335

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.31.0, inbound AMQP command assembly in src/main/java/com/rabbitmq/client/impl/CommandAssembler.java processes a content-bearing method and header whose...

PT-2026-81361

Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid...

PT-2026-81170

The tagDiv Composer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vc raw html shortcode in all versions up to and including 5.4.5. This is due to insufficient input sanitization and output escaping in the vc raw html::render method, which base64-decodes shortcode conte...

PT-2026-81907

Kimai before 2.64.0 contains a missing authorization vulnerability in the ProjectViewController export route report project view export. The authorization guards are attached to the sibling invoke method rather than at the class level, so the export route inherits no authorization checks. Any...

PT-2026-81158

Name of the Vulnerable Software and Affected Versions NLTK versions prior to 3.10.0 Description An unsafe pickle deserialization issue exists in the TransitionParser.parse function. The function utilizes pickle load with the restricted parameter set to False, which directs deserialization through...

PT-2026-81358

Nokogiri versions before 1.19.4 contain a possible invalid out-of-bounds memory read in the protected internal Nodeinitialize copy with args helper behind Nodedup and clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method wit...

python-pyasn1 security update

0.3.7-6.2 - Fix denial of service in Real type float method CVE-2026-59886 - Resolves: RHEL-217908...

PT-2026-81363

Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in SystemTwigSecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent models...

A Drop-In KEM Replacement for Client Signatures in Post-Quantum SSH

The transition to post-quantum cryptography is reshaping the Secure Shell SSH protocol for remote administration. Post-quantum key exchange has been deployed in OpenSSH and is being standardized, while SSH authentication largely remains a signature-replacement effort. This path preserves the...

PT-2026-81993

genieacs-mcp exposes a local Streamable HTTP MCP endpoint that accepts attacker-controlled Host and Origin headers. A malicious web page can use DNS rebinding to route browser requests to a victim's loopback MCP listener while preserving the attacker origin. The server accepts the request,...

CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

CVE-2026-78683

NLTK before 3.10.0 affected versions =3.9.4 contains an unsafe pickle deserialization vulnerability in the TransitionParser.parse method nltk/parse/transitionparser.py. The method calls pickleload with the default restricted=False, routing deserialization through WarningUnpickler, which does not...

PT-2026-81320

Name of the Vulnerable Software and Affected Versions PraisonAI versions prior to 4.6.58 Description The MCP HTTP Stream transport in PraisonAI uses an unsafe prefix match when validating the Origin header via the validate origin method. The validation logic accepts any origin that starts with an...

UBUNTU-CVE-2026-63074

Issue summary: The OpenSSL Certificate Management Protocol CMP caches additional certificates extraCerts sent in a CMP message, but never expunges them for instance if they are invalid. If a server reuses an OSSLCMPCTX frequently, this cache of extraCerts may grow unboundedly, and a malicious...

Linux Distros Unpatched Vulnerability : CVE-2026-19953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - URI versions before 5.36 for Perl encode non-NFC host names to non-standard punycode labels via missing normalization in nameprep. nameprep lowercases each host...

RHEL 9 : osbuild-composer (RHSA-2026:59562)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:59562 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...