Important: rust

Issue Overview: gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwriteexisting enabled, attackers can craft malicious...

Important: rust-cargo-c

Issue Overview: gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwriteexisting enabled, attackers can craft malicious...

EulerOS 2.0 SP13 : sqlite (EulerOS-SA-2026-4200)

According to the versions of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue in SQLite before Fossil check-in 869a51ae84df allows a local attacker to obtain sensitive information via the Session Extension changeset...

EulerOS 2.0 SP13 : glib2 (EulerOS-SA-2026-4048)

According to the versions of the glib2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in GLib. A buffer over-read can occur in the gregexreplace function when used with the GREGEXRAW compile flag and case-change...

EulerOS 2.0 SP11 : perl-Archive-Tar (EulerOS-SA-2026-4358)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory...

Amazon Linux 2023 : cargo-c (ALAS2023-2026-3181)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3181 advisory. gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation...

Amazon Linux 2 : amazon-ecr-credential-helper (ALASNITRO-ENCLAVES-2026-121)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.12.0-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2NITRO-ENCLAVES-2026-121 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations...

EulerOS 2.0 SP11 : open-iscsi (EulerOS-SA-2026-4260)

According to the versions of the open-iscsi packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A stack buffer overflow vulnerability exists in the idbmrecinfoconfig function in open-iscsi iscsi- initiator-utils. An attacker can craft a...

PT-2026-110465

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege...

EulerOS 2.0 SP11 : cpio (EulerOS-SA-2026-4310)

According to the versions of the cpio packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : GNU cpio is vulnerable to improper encoding or escaping of output in its archive member listing functionality. When listing archive members via cpio...

CVE-2026-103060: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

PT-2026-110631

Name of the Vulnerable Software and Affected Versions erlang rebar3 versions 3.7.0-rc1 through 3.27.1 Description A path traversal issue exists where a malicious package publisher can delete a directory outside the project's build directory and extract package files into it when a developer fetch...

EulerOS 2.0 SP13 : sssd (EulerOS-SA-2026-4110)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPa...

Amazon Linux 2023 : rsyslog, rsyslog-crypto, rsyslog-elasticsearch (ALAS2023-2026-3157)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3157 advisory. rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically...

Amazon Linux 2 : apache-ivy (ALAS-2026-3993)

The version of apache-ivy installed on the remote host is prior to 2.3.0-4. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3993 advisory. The PackagerResolver of Apache Ivy is able to download onlineartifacts and to repackage them in a format defined by apackager.xm...

Amazon Linux 2 : rsyslog (ALAS-2026-3967)

The version of rsyslog installed on the remote host is prior to 8.24.0-57. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3967 advisory. rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid...

CVE-2026-21137: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege...

PT-2026-110870

Name of the Vulnerable Software and Affected Versions gleam versions 0.32.4 through 1.19.1 Description A path traversal issue exists where a malicious package publisher can cause the deletion of directories outside the project build directory. This occurs because Gleam reads the app field from th...

CVE-2026-109354: Improper Limitation of a Pathname to a Restricted Directory

LibreNMS before 26.9.0 contains a path traversal vulnerability in nfsenchannelcommon.inc.php that allows authenticated users to read unauthorized RRD data by injecting ../ sequences into the channel parameter. Attackers with access to one NFSen-enabled device can request graph.php with a traverse...

CentOS Linux 6 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS6:CLSA-2026:1791331932)

The CentOS Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS6:CLSA-2026:1791331932 advisory. - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands...