CVE-2026-66384 Authenticated users may write data outside the intended Docker cache path

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions...

CVE-2026-66384

JFrog Artifactory is affected by an improper limitation of a pathname to a restricted directory , allowing an authenticated user to write data outside the intended Docker cache path under specific remote-repository conditions. The vulnerability carries a CVSS score of 5.3 (MEDIUM) with high integ...

CVE-2026-66382

Technical details for CVE-2026-66382 are not publicly available in the provided documents. Monitor official advisories for updates.

CVE-2026-66382 Authenticated users may write files outside the intended Artifactory work directory

An authenticated user may write files outside the intended Artifactory work directory under specific conditions...

EUVD-2026-57251

An authenticated user may write files outside the intended Artifactory work directory under specific conditions...

CVE-2026-66381

Technical details are not publicly available in the provided documents. Monitor for updates.

EUVD-2026-57250

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

CVE-2026-66381 Repository readers may access content outside configured upstream paths

A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions...

CVE-2026-73291

Seerr (open-source media manager for Jellyfin/Plex/Emby) prior to v3.4.0 contains a flaw in ImageProxy: the code uses upstream ETag and Content-Type headers to build the cache filename for the unauthenticated GET /avatarproxy/:jellyfinUserId route. This allows a malicious or compromised Jellyfin/...

CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

CVE-2026-73291 Seerr: Path traversal to RCE via /avatarproxy image cache filename from upstream ETag

Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. Prior to version 3.4.0, Seerr's ImageProxy in server/lib/imageproxy.ts uses the upstream ETag and Content-Type response headers to build a cache filename for the unauthenticated GET...

iscsi-initiator-utils security, bug fix, and enhancement update

An update is available for iscsi-initiator-utils. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The iscsi-initiator-utils packages provide the server daemon f...

RLSA-2026:53845 Important: iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol IP networks...

Security update for python3

This update for python3 fixes the following issues: CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. CVE-2026-1703: files may be extracted outside the installation directory when installing and...

SUSE-SU-2026:3601-1 Security update for python3

This update for python3 fixes the following issues: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-1703: files may be extracted outside the installation directory when installing and...

Improper Neutralization Of Argument Delimiters (Argument Injection)

Apache Camel is vulnerable to Improper Neutralization of Argument Delimiters. The vulnerability is due to insufficient validation of custom CLI arguments and path values supplied through Camel headers, which allows an attacker who can influence these values to inject unintended docling command-li...

CVE-2026-18652

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...

CVE-2026-18652 Velociraptor STACK Type Download Path Bypasses Denied Prefix Check

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...

EUVD-2026-57161

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...

CVE-2026-18652 Velociraptor STACK Type Download Path Bypasses Denied Prefix Check

Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied prefixes. In particular, a...