Security update for erlang26

This update for erlang26 fixes the following issues: CVE-2026-28810: predictable DNS transaction IDs can cause DNS cache poisoning bsc1261726. CVE-2026-42789: publickey application accepts non-CA certificates as intermediate issuers and this enables chain forgery bsc1266449. CVE-2026-42790: Name...

Microsoft PowerShell Remote Code Execution Vulnerability

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network...

Microsoft SharePoint Server Information Disclosure Vulnerability

Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

.NET Framework Elevation of Privilege Vulnerability

Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally...

Microsoft Teams Remote Code Execution Vulnerability

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...

JLSEC-2026-1248 A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL...

A flaw was found in GLib. The D-Bus client-side implementation of the DBUSCOOKIESHA1 SASL authentication mechanism does not validate the cookiecontext parameter received from the server. A malicious D-Bus server can supply a cookiecontext containing path traversal sequences, causing the client to...

CVE-2026-72783

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

CVE-2026-72770

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...

CVE-2026-69109

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

CVE-2026-71556

A flaw was found in go-git, an extensible Git implementation library. Worktree operations, such as checkout, status, and add, resolve symbolic links within the working tree without proper boundary confinement. This allows a remote attacker to craft a malicious repository containing a symlink,...

CVE-2026-69109

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

CVE-2026-69109

Siemens License Server (SLS) is affected across all versions

CVE-2026-69109

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

EUVD-2026-56126

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

CVE-2026-72602

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and return...

CVE-2026-72604

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72783

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

CVE-2026-72783

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the Local file system class’s ensurePathIsContained function. The vulnerability stems from validating the path before normalization, creating a desanitization-style ...

EUVD-2026-56107

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

CVE-2026-72783 Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...