CVE-2026-61446 PraisonAI before 1.6.78 Remote Code Execution via Plugin Auto-Discovery

PraisonAI praisonaiagents before 1.6.78 contains a remote code execution vulnerability in the plugin manager, which loads and executes arbitrary Python .py files from project-level and user-home .praisonai/plugins/ directories using importlib specfromfilelocation and execmodule without code...

Exploit for Path Traversal in Apache Http_Server

CVE-2021-41773 The GREENDARK hospi...

Path Traversal

github.com/k3s-io/k3s is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths in the etcd snapshot decompression functionality when restoring compressed ZIP-based snapshots, which allows an attacker to craft archive entries with malicious file names that wri...

Path Traversal

SiYuan is vulnerable to Path Traversal. The vulnerability is due to improper validation of double URL-encoded path traversal sequences in the /assets/path route, where attackers can bypass path restrictions to read arbitrary files within the workspace directory, exposing sensitive configuration...

Exploit for Path Traversal in Mindsdb

CVE-2026-27483 Lab - Enterprise Vulnerability Learning Environ...

Security Bulletin: IBM Cloud Pak for Data System (CPDS 1.0) is affected by multiple vulnerabilities due to pip

Summary pip is used by IBM Cloud Pak for Data System 1.0 as the Python package installer for managing and installing Python software packages. Multiple vulnerabilities affect pip. CVE-2026-1703 involves a path traversal vulnerability where files from a maliciously crafted wheel archive may be...

PT-2026-60310

Name of the Vulnerable Software and Affected Versions Node Version Manager nvm versions 0.32.1 through 0.40.5 Description An issue exists where nvm ls-remote and other commands that refresh remote LTS aliases, such as nvm install --lts, parse the node.js mirror's index.tab and use the LTS codenam...

PT-2026-60234

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.5 Splunk Enterprise versions prior to 10.0.8 Splunk Enterprise versions prior to 9.4.13 Splunk Enterprise versions prior to 9.3.14 Splunk Cloud Platform versio...

PT-2026-58886

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, Notepad++ validates the backupFilePath attribute from session.xml with std::wstring::starts with against the expected backup directory without path normalization, allowing parent-directory sequences during snapshot-mode...

PT-2026-58888

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.7 Description The WinGup decompress function fails to perform canonical containment validation when joining untrusted ZIP entry names to unzipDestTo. This allows a specially crafted ZIP entry, such as...

Adobe Experience Manager 6.5.0 < 6.5.2 / 2026.5.0 < 2026.6.0 Multiple Vulnerabilities (APSB26-74)

The version of Adobe Experience Manager installed on the remote host is prior to 2026.6.0, 6.5.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-74 advisory. - Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Director...

PT-2026-60214

Name of the Vulnerable Software and Affected Versions File Browser versions 2.63.6 through 2.63.16 Description The archive builder improperly handles filenames by using strings.ReplaceAllnameInArchive, "", "/". This allows a user with upload permissions to create a file with backslashes in the...

Splunk Enterprise 9.3.0 < 9.3.14, 9.4.0 < 9.4.13, 10.0.0 < 10.0.8, 10.2.0 < 10.2.5, 10.4.0 < 10.4.1 (SVD-2026-0703)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2026-0703 advisory. - In Splunk Enterprise versions below 10.4.1, 10.2.5, 10.0.8, 9.4.13, and 9.3.14, and Splunk Cloud Platform versions below...

Linux Distros Unpatched Vulnerability : CVE-2026-59733

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-rep...

PT-2026-58887

Name of the Vulnerable Software and Affected Versions Notepad++ versions prior to 8.9.7 Description The expandNppEnvironmentStrs function in PowerEditor/src/WinControls/StaticDialog/RunDlg/RunDlg.cpp copies a variable name located between $ and into a fixed-size wchar t strMAX PATH stack buffer...

PT-2026-60218

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine versions prior to 3.3 Cisco Identity Services Engine versions 3.3 through 3.3 before Patch 12 Cisco Identity Services Engine versions 3.4 through 3.4 before Patch 7 Cisco Identity Services Engine versions 3.5...

CVE-2026-15751

A security vulnerability has been detected in mastergo-design mastergo-magic-mcp up to 0.2.0. The affected element is the function execute of the file mastergo/component-workflow.md of the component mcpgetComponentGenerator. The manipulation of the argument rootPath leads to path traversal. An...

CVE-2026-59733

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...

DEBIAN-CVE-2026-59733

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone serve restic --private-repos enforces authorization using the routed user path segment while building the backend object key from the raw uncleaned URL path,...

CVE-2026-59732

Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write extracted files outside the user-selected destination prefix when extracting a crafted archive containing parent path components such as...