PT-2026-111114

A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save cimatrix results in path traversal. The attack may be initiated remotely. The...

AlmaLinux 9.6 [TuxCare] Security Update: ignition / ignition-edge / ignition-grub / ignition-validate (ALMALINUX9.6:CLSA-2026:1791487723)

"The AlmaLinux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791487723 advisory. - gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input...

Amazon Linux 2023 : cargo, clippy, rust (ALAS2023-2026-3170)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3170 advisory. gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During...

Rocky Linux 9.6 [TuxCare] Security Update: ignition / ignition-edge / ignition-grub / ignition-validate (ALMALINUX9.6:CLSA-2026:1791487723)

"The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1791487723 advisory. - gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input...

EulerOS 2.0 SP11 : spice-vdagent (EulerOS-SA-2026-4290)

According to the versions of the spice-vdagent packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files ...

PT-2026-121707

TuxCare rebuilt path-to-regexp to address 1 CVE. Fixed in 0.1.10-tuxcare.2...

PT-2026-110428

Name of the Vulnerable Software and Affected Versions westboy CicadasCMS versions prior to 2431154dac8d0735e04f1fd2a3c3556668fc8dab Description A remote path traversal flaw exists in the Backend Template Editor component. The issue occurs within the TemplateController.save function located in the...

PT-2026-110620

🚨 CVE-2026-108899 A flaw has been found in tobychui zoraxy up to 3.3.4. This impacts the function handleBasicAuth of the file mod/dynamicproxy/authProviders.go of the component Path Exception Matcher. This manipulation of the argument PathPrefix causes improper authorization. It is possible to...

CVE-2026-21133: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Samsung Flow prior to version 4.9.22.1 allows local attackers to access clipboard data...

PT-2026-110487

Name of the Vulnerable Software and Affected Versions OTRS versions 6.x and earlier OTRS versions 7.0.x through 2026.6.x Description A path traversal issue in the SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This can...

Medium: apache-ivy

Issue Overview: The PackagerResolver of Apache Ivy is able to download online artifacts and to repackage them in a format defined by a packager.xml file. This repackaging is done by an Ant script, which is stored in a subdirectory of the configured "buildRoot" directory. This subdirectory is...

PT-2026-110871

Name of the Vulnerable Software and Affected Versions copyparty versions prior to 1.20.19 Description FTP upload path handling fails to confine destinations to configured volumes. When FTP or FTPS is enabled, a low-privileged authenticated user can use traversal paths during upload to create new...

PT-2026-110468

Name of the Vulnerable Software and Affected Versions Metasploit Framework affected versions not specified Description The post module post/apple ios/gather/ios image gather contains a relative path traversal issue. The module takes file names from a Meterpreter directory listing, which can be...

CVE-2021-48011: Improper Limitation of a Pathname to a Restricted Directory

Servor 1.0.0 through 4.0.2 contains a path traversal vulnerability that allows unauthenticated remote attackers to escape the served root by sending URL-encoded dot segments. Attackers can send %2e%2e/ sequences, which decodeURI decodes before path.join in serveStaticFile and serveDirectoryListin...

Important: rsyslog

Issue Overview: rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a valu...

Important: rust

Issue Overview: gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwriteexisting enabled, attackers can craft malicious...

PT-2026-110691

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-32 Description A time-of-check time-of-use TOCTOU symlink race occurs when executing a magick script. This allows attackers to bypass the path security policy by swapping a checked path with a symlink during...

Amazon Linux 2023 : apache-ivy, apache-ivy-javadoc (ALAS2023-2026-3207)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-3207 advisory. The PackagerResolver of Apache Ivy is able to download onlineartifacts and to repackage them in a format defined by apackager.xml file. This repackaging is done by an Ant script, which isstored in a...

EulerOS 2.0 SP13 : spice-vdagent (EulerOS-SA-2026-4108)

According to the versions of the spice-vdagent packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files ...

EulerOS 2.0 SP13 : spice-vdagent (EulerOS-SA-2026-4199)

According to the versions of the spice-vdagent packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files ...