Linux Distros Unpatched Vulnerability : CVE-2026-62384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus...

EUVD-2026-64192

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

CVE-2026-48105 Arc Enterprise cluster FSM applyRegisterFile accepts arbitrary file paths without validation, enabling cluster-wide path-traversal worm primitive

Arc is an open, SQL-native time-series database for telemetry. Prior to version 26.06.1, Arc Enterprise's Raft FSM internal/cluster/raft/fsm.go:applyRegisterFile accepts attacker-chosen file paths in manifest-registration proposals without validating them against the configured storage backend. T...

PT-2026-79360

Name of the Vulnerable Software and Affected Versions JuiceFS affected versions not specified Description The filestore backend in pkg/object/file.go, used for file:// stores and as a common sync destination, fails to verify if the target path remains within the root directory. The pathkey functi...

CVE-2026-73255

CVE-2026-73255 is a path traversal vulnerability in Mongoose (an embedded web server and network library) prior to version 7.22 . The root cause is in the mg_ssi() function in src/ssi.c , which concatenates the #include or #include virtual directive argument into a filesystem path without calling...

OESA-2026-3412 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: A flaw was found in samba's pamwinbind. When mkhomedir is enabled, pamwinbind chowns the target account's home directory without validating the path is not a critical system directory such as /. On...

CVE-2026-14947

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

EUVD-2026-63218

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

CVE-2026-76347

Splunk Secure Gateway's Report Notifications REST API fails to validate notification path values before sending system-authenticated internal requests, allowing non-admin users to trigger SSRF, alter Search Head Cluster state, and cause denial of service. Affected versions: Splunk Enterprise belo...

CVE-2026-76345

CVE-2026-76345 is a remote code execution vulnerability in Splunk Enterprise versions below 10.4.2 (also affecting 10.2.x, 10.0.x, and 9.4.x branches). The search head cluster member bundle REST API fails to enforce its expected authorization boundary and does not validate bundle paths before acc...

Important: Red Hat Security Advisory: osbuild-composer security update

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

PT-2026-78772

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions 10.4 through 10.4.1 Description A user with a high-privilege role capable of managing search head clustering can exploit the search head cluster member bundle REST API to write files to locations accessible by the...

PT-2026-80655

Summary confluence upload attachment passes file path directly to openfile path, "rb" with no path validation. Any authenticated MCP client — or an AI agent manipulated via prompt injection — can read any file the server process can access and exfiltrate it to Confluence as an attachment. Details...

RHEL 9 : osbuild-composer (RHSA-2026:56959)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:56959 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for...

chrome-devtools-mcp: validatePath() does not canonicalize symlinks before enforcing roots

Summary I originally reported this through Google Bug Hunters. The Google Bug Hunters team said this is in OSS VRP scope but not reward-eligible due to the project tier, and asked me to file an issue or PR directly with this repository. I am reporting it privately here first because it is an...

PT-2026-82817

Name of the Vulnerable Software and Affected Versions Suricata-Update affected versions not specified Description Suricata-Update fails to properly validate destination paths during the extraction of files from downloaded rule archives. This flaw allows an attacker to write arbitrary files outsid...

PT-2026-82818

Fix: PR 7906 ether/etherpad. A set of medium/low hardening fixes: - Weak RNG for tokens CWE-330: author/session/readonly IDs were generated with Math.random client and server. Now use crypto.getRandomValues. - Login timing / no failure delay CWE-208/CWE-307: the OIDC interaction login used a...

CVE-2026-16099

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the createlinkitem function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-16099

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to 4.5.3 due to insufficient file path validation in create_link_item. Authenticated attackers with contributor-level access can delete arbitrary server files, potentially enabling remot...

CVE-2026-16099

The Podlove Podcast Publisher plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the createlinkitem function in all versions up to, and including, 4.5.3. This makes it possible for authenticated attackers, with contributor-level access and...