CVE-2026-107275: Detection of Error Condition Without Action

@fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore, or maxAge that the plugin's parser cannot read, such as a compound span, a month unit, an ISO 8601 duration, a decimal comma, or a value with surrounding...

CVE-2026-86828: Improper Limitation of a Pathname to a Restricted Directory

The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code...

PT-2026-108040

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

sssd security update

2.12.0-3.0.1.el102.2 - Restore default debug level for ssscache Orabug: 32810448 2.12.0-3.2 - Resolves: RHEL-257112 - CVE-2026-87853 sssd: IDP prefix-match bypass in evalaccesstokenbuf 2.12.0-3.1 - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tre...

PT-2026-108208

Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions prior to 12.7.0 Description Built-in HTTPS transports in this Fastify plugin override the secure default by setting rejectUnauthorized to false. This prevents the proxy from verifying the TLS certificate of the...

PT-2026-108182

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An unauthenticated attacker can exploit a path traversal issue within the GIM file-upload functionality to write arbitrary files to the Collector. Path traversal is a technique that allows ...

PT-2026-108152

Name of the Vulnerable Software and Affected Versions ppt2png versions 0.0.1 through 0.0.6 Description An OS command injection flaw exists where attackers can execute operating system commands by providing unsanitized input or output path arguments. This occurs when shell metacharacters, such as ...

CVE-2026-5049: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

CVE-2026-103663: Relative Path Traversal

Ollama is vulnerable to path traversal in the /api/pull endpoint due to insufficient validation of layer digests by the digestToPath function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model...

CVE-2026-107377: Improper Limitation of a Pathname to a Restricted Directory

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf schema can supply absolute or parent-directory paths captured by WEAKIMPORTPATTERN and consumed by writemissingweakimports in...

PT-2026-107950

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.35.0 Description An unauthenticated remote attacker can exploit a path traversal issue via the '/api/pull' endpoint. This occurs because the digestToPath function does not sufficiently validate layer digests, allowin...

ONLYOFFICE Docs Server Path Traversal Vulnerability

ONLYOFFICE Docs contains a path traversal vulnerability that can occur when JWT is used, via a /.. sequence in an image upload parameter and could allow for remote code execution...

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : Libwebsockets vulnerabilities (USN-8893-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8893-1 advisory. It was discovered that libwebsockets did not properly validate user-supplied data when parsing HTTP/2...

CVE-2026-84247: Improper Limitation of a Pathname to a Restricted Directory

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

MiracleLinux 8 : tar-1.30-13.el8_10 (AXSA:2026-1944:04)

The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2026-1944:04 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X...

CVE-2026-85487: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

CVE-2026-85490: Improper Limitation of a Pathname to a Restricted Directory

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-4010)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-3944)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...

Visual Studio Code Path Traversal

The vulnerability of Visual Studio Code’s source editor is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...