PT-2026-84040

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions prior to 11.11.0 Description pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because the pickPackage.ts function rejects slash characters only for unscoped...

PT-2026-83992

Name of the Vulnerable Software and Affected Versions Wallos versions prior to 4.9.6 Description An issue exists where the application fails to validate entry names for directory traversal sequences when processing zip files. An administrator can upload a specially crafted zip archive to the 'POS...

EUVD-2026-68878

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILENAME value used by setfilename and loadmetadata in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILENAME value with the settings director...

PT-2026-84039

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions 11.0.0 through 11.10.0 Description pnpm improperly parses package names from the pnpm-lock.yaml file using the dp.parsedepPath.name function without sufficient validation. This occurs within...

RHEL 10 : iscsi-initiator-utils (RHSA-2026:61679)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61679 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as the utilit...

Linux Distros Unpatched Vulnerability : CVE-2026-82253

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide Rust crates gix = 0.72.0 and gix-validate = 0.10.0 contains a path traversal vulnerability. The submodule name validation function in gix-validate only...

Langflow 1.8.4 Path Traversal / Remote Code Execution

Langflow versions 1.8.4 and below path traversal to remote code execution proof of concept exploit. Exploit Title: Langflow 1.8.4 - Path Traversal to Remote Code Execution Google Dork: N/A Date: 2026-07-20 Exploit Author: cardosource Vendor Homepage: https://www.langflow.org/ Software Link:...

Langflow 1.8.4 - Path Traversal to Remote Code Execution

Exploit Title: Langflow 1.8.4 - Path Traversal to Remote Code Execution Google Dork: N/A Date: 2026-07-20 Exploit Author: cardosource Vendor Homepage: https://www.langflow.org/ Software Link: https://github.com/langflow-ai/langflow Version: Dictstr, Any: return "target": target.rstrip'/', "lhost"...

CVE-2026-79407

CVE-2026-79407 is a path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 . The vulnerable code resides in metagpt/ext/spo/utils/load.py, where set_file_name() and load_meta_data() join an attacker-controlled FILE_NAME value with the settings directory and open the resulting path wit...

CVE-2026-79407

A path traversal vulnerability in the SPO extension of MetaGPT 0.8.1 allows an attacker to read arbitrary files via the FILENAME value used by setfilename and loadmetadata in metagpt/ext/spo/utils/load.py. The vulnerable code joins the attacker-controlled FILENAME value with the settings director...

PT-2026-84052

Name of the Vulnerable Software and Affected Versions Dokploy versions prior to 0.29.8 Description An unauthenticated path traversal issue exists in the Settings component. The writeTraefikConfigInPath function within the packages/server/src/utils/traefik/application.ts file fails to properly...

PT-2026-83818

Name of the Vulnerable Software and Affected Versions Eclipse Theia versions 1.73.0 through 1.74.x Description In AI Agent Mode, file-change tools resolve model-supplied file paths without verifying if they are contained within the workspace. This allows a crafted relative path, an absolute path,...

Linux Distros Unpatched Vulnerability : CVE-2026-59280

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from...

ALSA-2026:61766 Moderate: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: buffer over-read in...

Debian dla-4764 : libdbi-perl - security update

The remote Debian 11 / 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4764 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4764-1 [email protected]...

Amazon Linux 2023 : libgit2, libgit2-devel (ALAS2023-2026-2083)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2083 advisory. libgit2 Inverted IP SubjectAltName Comparison in OpenSSL Backend vuln111 CVE-2026-53583 libgit2 Submodule path traversal CVE-2026-53584 Unbounded Memory Allocation via Delta Object Result-Size...

Linux Distros Unpatched Vulnerability : CVE-2026-82251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - gitoxide before 0.52.1 fails to validate submodule names from .gitmodules configuration, allowing path traversal when deriving submodule git directories...

Moderate: glib2 security update

GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures. Security Fixes: glib: buffer over-read in...

RHEL 8 : glib2 (RHSA-2026:61766)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61766 advisory. GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in...

Amazon Linux 2023 : golang, golang-bin, golang-misc (ALAS2023-2026-2114)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2114 advisory. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures. CVE-2026-33818 When a server is configured to support unencrypted HTTP/2, i...