CVE-2026-42574 apko dirFS has a symlink-following path traversal that allows multiple entry points to escape the build root

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

EUVD-2026-28932

apko allows users to build and publish OCI container images built from apk packages. From version 0.14.8 to before version 1.2.5, a crafted .apk could install a TypeSymlink tar entry whose target pointed outside the build root, and a subsequent directory-creation or file-write entry in the same o...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: podman: podman-5.8.2-1.1.hum1 aarch64, x8664 podman-docker-5.8.2-1.1.hum1 noarch podman-machine-5.8.2-1.1.hum1 aarch64, x8664 podman-remote-5.8.2-1.1.hum1 aarch64, x8664 podman-tests-5.8.2-1.1.hu...

@claspo/common (>=5.2.1-theme.13, <=7.4.0), @claspo/components (>=1.1.14, <=1.10.12) +3 more potentially affected by CVE-2026-44966 via velocityjs (2.0.6)

velocityjs NPM version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on velocityjs and may be impacted: - @claspo/common =5.2.1-theme.13, =1.1.14, =14.5.0-theme.13, =16.5.0-theme.13, =14.4.1-theme.13, =16.4.0 Source cves: CVE-2026-44966 Source...

Linux Distros Unpatched Vulnerability : CVE-2025-71296

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/tests: shmem: Hold reservation lock around purge Acquire and release the GEM object's reservation lock around calls to the object's purge operation. The tes...

Amazon Linux 2023 : java-11-amazon-corretto, java-11-amazon-corretto-devel, java-11-amazon-corretto-headless (ALAS2023-2026-1685)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1685 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

apko 路径遍历漏洞

Apko is an open-source OCI image builder based on APK. In versions 0.14.8 to 1.2.5 of Apko, there was a path traversal vulnerability. This vulnerability occurred because specially crafted APK packages could install entries that pointed to directories other than the build root directory. This...

Amazon Linux 2023 : java-21-amazon-corretto, java-21-amazon-corretto-devel, java-21-amazon-corretto-headless (ALAS2023-2026-1683)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1683 advisory. Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Security. Supported versions that are affected are Oracle Ja...

Important Photon OS Security Update - PHSA-2026-5.0-0844

Updates of 'linux-esx', 'linux' packages of Photon OS have been released...

Linux Distros Unpatched Vulnerability : CVE-2026-43454

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftables: Fix for duplicate device in netdev hooks When handling NETDEVREGISTER notification, duplicate device registration must be avoided since the...

Moderate: Red Hat Security Advisory: OpenShift Container Platform 4.12.88 packages and security update

Red Hat OpenShift Container Platform release 4.12.88 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.12. Red Hat Product Security has rated this update as having a...

@arnica-io/dependency-scan (>=1.0.30, <=1.0.31), @herodevs/cli (>=1.0.0-beta.2, <=2.0.0-beta.4) +3 more potentially affected by unknown CVE via @cyclonedx/cdxgen (>=10.11.0, <=11.11.0)

@cyclonedx/cdxgen NPM version =10.11.0, =1.0.30, =1.0.0-beta.2, =0.10.0, =0.1.0, =1.3.0, =1.6.1 Source cves: unknown CVE Source advisory: OSV:GHSA-QHH4-458H-XWH2...

GHSA-2755-2MM4-RM5C vulnerabilities

Vulnerabilities for packages: python...

GHSA-37P6-C4XV-CQ5Q vulnerabilities

Vulnerabilities for packages: linux-gcp, linux-aws, linux-qemu...

@activepieces/piece-ai (>=0.3.1, <=0.3.4), @middy/validator (>=5.4.3, <=5.4.4) +4 more potentially affected by CVE-2026-6322 via fast-uri (>=3.0.1, <=3.1.0)

fast-uri NPM version =3.0.1, =0.3.1, =5.4.3, =1.0.0, =1.0.0, =2.2.0, =2.3.1 Source cves: CVE-2026-6322 Source advisory: OSV:GHSA-V39H-62P7-JPJC...

GHSA-3RF6-X59V-5JFV dash-uploader has a directory traversal vulnerability

Impact An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at dashuploader/httprequesthandler.py reads three form parameters uploadid, resumableFilename, resumableIdentifier from request.form.get and passes the...

dash-uploader has a directory traversal vulnerability

Impact An unauthenticated path traversal vulnerability exists in dash-uploader versions 0.1.0 through 0.7.0a2. The library's HTTP request handler at dashuploader/httprequesthandler.py reads three form parameters uploadid, resumableFilename, resumableIdentifier from request.form.get and passes the...

Directory Traversal

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

aurora-cycler-manager (>=0.10.0, <=0.11.4), fusion-tools (>=3.6.19, <=3.6.90) +9 more potentially affected by CVE-2026-38361 via dash-uploader (>=0.6.0, <=0.7.0a2)

dash-uploader PYPI version =0.6.0, =0.10.0, =3.6.19, =0.0.11, =0.0.30, =0.2.4b0, =0.0.50.0, =0.1.7.3, =2.0.1, =0.2.0, =0.4.1 Source cves: CVE-2026-38361 Source advisory: SNYK:PYTHON-DASHUPLOADER-16635848...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +283 more potentially affected by CVE-2026-44008 via vm2 (>=3.0.0, <=3.11.1)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.0, =2.1.1, =0.1.1, =1.0.0, =1.4.0 and more Source cves:...