CVE-2026-81730

Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $path . $filename . '.' . $ext and hands it ...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2 , the options.fileName value passed to path.join(tempDir.name, fileName) in index.js is never reduced to a base name. A filename containing ../ allows an attacker to escape the temporary d...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

CVE-2026-54732 libreoffice-convert: path traversal / arbitrary file write

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

EUVD-2026-67160

Silverstripe Advanced Workflow is a highly configurable step-based workflow module. Prior to 6.4.5, 7.1.3, and 7.2.1, an attacker with permission to author the advanced workflow email template can place a specially crafted server-side template payload in NotifyUsersWorkflowAction.EmailTemplate...

Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

Malicious Package

Overview module-relpath is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-14561 Malicious code in module-relpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03bf564e2647cb828bb130eaaba71b21fb6d78928cb6e3a74165bbb2fc546b98 The package presents itself as relative-import-path README title, homepage and repository URL point at github.com/marko-js/relative-import-path, and...

CVE-2026-80556

A flaw was found in the Linux kernel's atmel-mci component. A race condition during the removal of the atmel-mci module can lead to a use-after-free vulnerability. This occurs when work items related to the module are still pending or running after the associated memory has been freed. This flaw...

CVE-2026-80206

A flaw was found in NLTK, specifically within its tgrep module. This vulnerability, known as Regular Expression Denial of Service ReDoS, allows a remote attacker to provide specially crafted regular expressions. When processed, these expressions can cause indefinite CPU saturation, leading to a...

CVE-2026-80519

A flaw was found in the Linux kernel. Specifically, within the OpenVPN OVPN module's crypto completion callback mechanism, a timing issue exists. This vulnerability arises when peer references are released prematurely, before the associated cleanup operations are complete. An attacker could...

CVE-2026-76226

A flaw was found in Renovate. This vulnerability affects the bazel-module and bazelisk managers when processing lockFileMaintenance. A remote attacker can exploit this by providing malicious dependencies, leading to the execution of arbitrary code. This occurs when these dependencies are referenc...

CVE-2026-80520

A flaw was found in the ovpn module of the Linux kernel. The ovpncryptokillkey function incorrectly assumes that both crypto key slots are always populated. This can lead to a NULL dereference if a peer has only one installed key or if the function attempts to remove a key that is not present. A...

CVE-2026-80522

A flaw was found in the Linux kernel's Tegra cryptography module. An incorrect calculation in the 'tegragcmdoonereq' function, specifically when handling the 'cryptlen' parameter, can occur if a caller does not properly initialize the authentication size. This can lead to a write beyond the...

SUSE CVE-2026-80519

In the Linux kernel, the following vulnerability has been resolved: ovpn: finish crypto callback cleanup before peer release Crypto completion callbacks hold both key-slot and peer references. The peer reference pins the netdev, and dropping the last peer reference can let netdev unregistration a...

SUSE CVE-2026-80520

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix NULL dereference when killing missing key ovpncryptokillkey assumes both crypto slots are populated and dereferences each slot before checking it. That is not guaranteed: a peer can have only one installed key, and the...

SUSE CVE-2026-80556

In the Linux kernel, the following vulnerability has been resolved: mmc: atmel-mci: Fix use-after-free in atmciremove due to race condition In atmciprobe, &host-bhwork is bound with atmciworkfunc, and atmciinterrupt, atmcitimeouttimer and atmcidmacomplete can all queue this work on systembhwq. If...

PT-2026-82688

libreoffice-convert is a Node.js module for converting office documents to different formats. Prior to 1.8.2, index.js uses the caller-controlled options.fileName value in path.jointempDir.name, fileName without reducing it to a base name. A filename containing ../ can escape the temporary...

Linux Distros Unpatched Vulnerability : CVE-2026-80158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the ipagetkeytab module of the community.general Ansible collection. The module's bindpw parameter, used to supply the LDAP simple-bind...