Directory Traversal

Overview unearth is an A utility to fetch and download python packages Affected versions of this package are vulnerable to Directory Traversal through the iswithindirectory check in untararchive and iswithindirectory in unearth’s tar extraction code. An attacker can write files outside the intend...

Malicious code in bigtime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d14cc45326877547d5297956e4c2b5719122bcef140db0d7959e1b4da94e58d7 The package presents itself as a time module wrapper, but its init.py invokes qwe900.init, which performs two exfiltration behaviors on import. First...

GHSA-4VR5-P2GC-H23P vulnerabilities

Vulnerabilities for packages: telegraf...

CVE-2026-19433

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

Exploit for Improper Input Validation in Widgetfactorylimited Jce

CVE-2026-65891 — Joomla JCE Rename PoC Proof-of-concept scann...

CVE-2026-19433 Authorization Bypass Through User-Controlled Key in Prospero Flow CRM contact save and vCard export

Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that contact's personal data as a vCard via the contact'...

DEBIAN-CVE-2026-68205

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...

CVE-2026-68205

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-fwnode: Fix subdev owner overwritten in v4l2asyncregistersubdevsensor The v4l2 helper v4l2asyncregistersubdevsensor calls v4l2asyncregistersubdev, which is a macro that expands to v4l2asyncregistersubdevsd,THISMODULE...

CVE-2026-68151

In the Linux kernel, the following vulnerability has been resolved: binfmtelffdpic: only honour the first PTINTERP The program header scan handles PTINTERP from a switch nested in the scan loop, so its break leaves the switch and not the loop. A binary carrying more than one PTINTERP runs the cas...

CVE-2026-68103

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

CVE-2026-68274 drm/xe/guc: Fix buffer overflow in steered register list allocation

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...

CVE-2026-72589

An OS command injection vulnerability in alseambusher/crontab-ui through 0.4.2 allows an unauthenticated remote attacker to execute arbitrary system commands by importing a crafted crontab database file. The POST /import endpoint accepts arbitrary .db files and overwrites the application database...

CVE-2026-17023

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-17023 Salon Booking System – Free Version <= 10.30.33 - Unauthenticated Google Calendar Connection Hijack via OAuth Callback

The Salon Booking System WordPress plugin through 10.30.33 does not perform any capability check or validate an OAuth state value on its Google Calendar authorization callback, which is also hooked for unauthenticated users, allowing an unauthenticated attacker to overwrite the site's stored Goog...

CVE-2026-68274: Out-of-bounds Write

In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask gdssmask to determine the number of entries to allocate: total =...

PT-2026-69848

Name of the Vulnerable Software and Affected Versions Roskus Prospero Flow CRM versions prior to 5.4.8 Description An authorization bypass exists in the contact management component. Authenticated users can overwrite contact data belonging to other companies or download personal data as a vCard b...

PT-2026-69350

Name of the Vulnerable Software and Affected Versions MotoPress Hotel Booking WordPress plugin versions prior to 6.2.3 Description An issue exists where the software fails to verify record ownership before updating customer records. This allows any authenticated user with low-privileged...

PT-2026-69504

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/amdgpu component where the system fails to reject the mapping of a reserved doorbell to a new queue. When creating a user-queue, the user space provides a...

CVE-2026-72903: Improper Limitation of a Pathname to a Restricted Directory

Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir and makeFile use POSIX path processing that preserves the backslashes a...