PT-2026-65896

Name of the Vulnerable Software and Affected Versions Flyto2 Core versions prior to 2.26.6 Description The image.download and related file-writing modules use a caller-controlled output dir instead of the validate path with env config function and its FLYTO SANDBOX DIR confinement. This allows...

WatchGuard FireWare OS sigd comp_start_cb Directory Traversal Arbitrary File Creation Vulnerability

This vulnerability allows remote attackers to create arbitrary files on affected installations of WatchGuard FireWare OS. Authentication is required to exploit this vulnerability. The specific flaw exists within the handling of signature package archives in the sigd service. The issue results fro...

CVE-2026-54659 Pagy I18n locale option is not validated before being used in a file path

Pagy is agnostic pagination in plain Ruby. From 43.0.0 until 43.5.6, Pagy::I18n.locale= in gem/lib/pagy/modules/i18n/i18n.rb stored locale values verbatim and later used them as .yml path components, allowing untrusted params:locale values with absolute paths or ../ sequences to create a file...

GHSA-WG2Q-39H6-66X9 goshs has a Path Traversal issue

Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write outside the served tree. Finding Medium: upload filename escapes the served tree residual of CVE-2026-35393 The multipart filename fix updown.go lines 135-136 splits on the path...

EUVD-2026-36072

Fission: SanitizeFilePath lexical HasPrefix bypass permits sibling-directory escape...

CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-56722 Dompdf: Local file read due to improper file path validation in SVG images encoded as data-URI

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, aAn attacker who controls the HTML input can bypass this restriction by embedding a target file path inside an SVG image delivered through a data: URI, because dompdf processes the SVG twice and the second pass does not...

CVE-2026-56722

Dompdf (PHP HTML-to-PDF library) prior to v3.16 is vulnerable to local-file read via SVG in a data: URI. The attack wraps a local file path in an SVG image; dompdf processes the SVG twice, and the second pass hands the image to php-svg-lib with external references enabled. php-svg-lib then reads ...

CVE-2026-55554

Dompdf is an HTML to PDF converter for PHP. In versions 3.15 and prior, the validateLocalUri method enforces chroot boundaries with a strpos prefix check after normalizing paths with realpath . Because normalization strips the trailing directory separator from $chrootPath , the check only...

GHSA-VCHH-R53J-8MPW Fission: HTTPTrigger admission omits RelativeURL / Prefix validation; kubectl apply bypasses CLI checks

HTTPTriggerSpec.Validate validated Methods, FunctionReference, Host, IngressConfig, and CorsConfig, but silently skipped RelativeURL and Prefix. Those two fields were validated at the CLI level only pkg/fission-cli/cmd/httptrigger/create.go:83. The post-CRD-modernization webhook for HTTPTrigger w...

vulnerabilities found in Apple MacOS

Apple has addressed several vulnerabilities in MacOS, specifically in the versions Sequoia 15.7.8, Sonoma 14.8.8, and Tahoe 26.x. These vulnerabilities involve various security issues in macOS, including insufficient sandbox restrictions, which may allow applications to gain unauthorized access t...

CVE-2026-17524

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

CVE-2026-17524

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

CVE-2026-17524

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

EUVD-2026-49687

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

CVE-2026-17524

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

CVE-2026-17524

Versions of the package zip-lib before 1.1.0 are vulnerable to Directory Traversal via the caching mechanism for path validation during the extraction process. An attacker can bypass security checks designed to prevent directory traversal. The intended security function, isOutsideTargetFolder, on...

CVE-2026-17524

The CVE-2026-17524 entry concerns the zip-lib package for Node.js, with versions before 1.1.0 vulnerable to Directory Traversal during extraction via the caching path-validation logic. The root cause is that the isOutsideTargetFolder check is only performed when the initial directory symlink is c...

FreeBSD : Erlang/OTP -- denial of service via exponential certificate policy tree growth (445d674f-89e1-11f1-b35c-4c526214c986)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 445d674f-89e1-11f1-b35c-4c526214c986 advisory. https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352 reports: A remote attacker can...

Linux Distros Unpatched Vulnerability : CVE-2026-59251

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits in Erlang/OTP publickey certificate path validation allows a remote unauthenticated attacker to cause denial of service b...