CVE-2026-47612

Summary: NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathname to a restricted directory, potentially leading to information disclosure. The CVSSv3.1 base score is 7.5 (High) with network attack vector and no ...

The vulnerability of the Grafana monitoring and surveillance platform lies in the improper restriction of the path name to the restricted access catalog, which allows a intruder to gain unauthorized access to protected information.

The vulnerability of the Grafana monitoring and observation platform is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the Sqlalchemy mako Python template library relates to incorrect path name restrictions for restricted access directories, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Sqlalchemy mako Python template library relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

AZL-94136 CVE-2026-56390 affecting package bison 3.8.2-1

GNU Bison improperly handles grammar‑defined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override caller‑supplied output options. When processing attacker-supplied grammar, this behavior allows directing...

The vulnerability of the authd and remoted processes of the monitoring and threat detection platform Wazuh allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the registration demon authd and the synchronization demon remoted of the Wazuh platform for security monitoring and threat detection is related to an incorrect restriction on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to gain...

Oracle Linux 10 : wireshark (ELSA-2026-20600)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-20600 advisory. - Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory - Resolves: RHEL-173218 - CVE-2026-5405 Heap-base...

CVE-2026-46338 PyMdown Extensions: Regression in pymdownx.snippets reintroduces sibling-prefix path traversal bypass despite restrict_base_path

PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.getsnippetpath in pymdownx/snippets.py when restrictbasepath: True, allowing markdown snippet directives t...

wireshark security update

4.4.2-10.0.1 - Fix post script to not fail during initial installation Orabug: 37565359 1:4.4.2-10 - Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory 1:4.4.2-9 - Resolves: RHEL-173218 - CVE-2026-5405 Heap-based Buffer Overflow 1:4.4.2-8 - Resolves:...

Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Summary A resource-scoped API token can read script contents outside its allowed path scope via GET /api/w/workspace/scripts/listsearch. This appears to be a remaining variant of the scoped-token authorization class previously addressed for other endpoints. The route-level scope middleware...

ROS-20260709-73-0034

The vulnerability in python-pip relates to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the ColdFusion software platform arises from an incorrect limitation on the path to the restricted access directory. This allows attackers to read arbitrary files.

The vulnerability of the ColdFusion software platform exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to remotely read arbitrary files...

The vulnerability of the ColdFusion software platform arises from an incorrect restriction on the path to the restricted directory. This allows attackers to execute arbitrary code.

The vulnerability of the ColdFusion software platform exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2026-54710

Name of the Vulnerable Software and Affected Versions Feast Feature Server affected versions not specified Description An unauthenticated remote attacker can write arbitrary JSON files to the server filesystem via the /save-document endpoint. The issue stems from improper input validation that...

Security update for gleam (moderate)

openSUSE security update: security update for gleam ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21143-1 Rating: moderate References: bsc1267396 bsc1267397 bsc1267398 Cross-References: CVE-2026-32685 CVE-2026-42795 CVE-2026-43965 Affected Product...

CVE-2026-13748 Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended...

CVE-2026-13748

CVE-2026-13748 affects Snowflake CLI prior to 3.19. The vulnerability arises from improper restriction of file path resolution, allowing an attacker-controlled repository or project content to cause the CLI to read arbitrary local files and transmit or embed their contents during deployment or SQ...

OPENSUSE-SU-2026:21143-1 Security update for gleam

This update for gleam fixes the following issues: Changes in gleam: - Update to 1.17.0: Fixed security vulnerabilities: - Restrict custom documentation page path and source values so gleam docs build cannot escape the docs output directory or project root bsc1267396, CVE-2026-32685 - Restrict...

CVE-2026-56446

MISP is affected by CVE-2026-56446 where an authenticated site administrator could configure an arbitrary filesystem path for the NDJSON error log via JsonLogTool. Logged data can contain attacker-controlled content, enabling direction of log output to a web-accessible PHP file and potentially in...

The vulnerability of the Trend Micro Apex One antivirus software arises from an incorrect limitation on the path to the catalog, allowing a malicious actor to execute arbitrary code.

The vulnerability of the Trend Micro Apex One antivirus software is related to an incorrect restriction on the path name to the catalog. Exploiting this vulnerability allows a hacker to execute arbitrary code...

The vulnerability of the UniFi OS Server network management center arises from incorrect restrictions on the path to the directory, allowing unauthorized access by intruders to protected information.

The vulnerability of the UniFi OS Server network management center is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...