PT-2026-107289

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description The push mirror API incorrectly validates permissions by checking if the repository owner, rather than the requesting user, is authorized to use local file system paths. On instances where the...

Brocade Fabric OS path traversal with USB management privileges (CVE-2026-94580)

: An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary...

CVE-2026-106552: Relative Path Traversal

In sftp in OpenSSH before 10.6, a server can trigger directory traversal causing files to be written to unintended locations during a recursive copy operation...

CVE-2026-101153: Improper Limitation of a Pathname to a Restricted Directory

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

PT-2026-115747

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if init path errors, the callee tries to clean up with rtrs clt close conns. However, this can lead to calling the event tracing code with clt path-kobj-name being NULL and...

Linux Distros Unpatched Vulnerability : CVE-2026-98201

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the...

Debian dla-4825 : suricata-update - security update

The remote Debian 12 host has a package installed that is affected by a vulnerability as referenced in the dla-4825 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-4825-1 [email protected] https://www.debian.org/lts/security/...

CVE-2026-86360: Improper Limitation of a Pathname to a Restricted Directory

Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This...

CVE-2026-105795: Improper Limitation of a Pathname to a Restricted Directory

Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.responsesemantics.oauthcardpath from an attacker-controlled or compromised OpenAPI description into a generated API plugin manifest without validating that the value is a safe...

CVE-2026-106186: Uncontrolled Search Path Element

Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 155.0.8059.39 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. Chromium security severity: Low...

CVE-2026-106103: Improper Limitation of a Pathname to a Restricted Directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder and name values from a user-supplied profile without constraining the resolved destination to the Quasar project...

PT-2026-115841

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

CVE-2026-98201: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

TeamViewer Desktop Clients Before 15.81.5 Path Traversal

TeamViewer Desktop Clients before version 15.81.5 contain a path traversal flaw in file transfer that may allow an authenticated remote session participant to write files outside the selected download directory...

PT-2026-115070

Name of the Vulnerable Software and Affected Versions OpenPrinting CUPS versions prior to 2.4.20 Description In the copy banner function within scheduler/ipp.c, the system improperly handles the attributes-natural-language value provided by a user when processing a job-sheets banner. An attacker...

Security Advisory 0189

Security Advisory 0189 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release 1.1 | October 13, 2026 | Updated Resolution section to include the 2026.3.0 release Description All CVEs covered in this advisory affect platforms running...

CVE-2026-79800: Improper Limitation of a Pathname to a Restricted Directory

An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges on the underlying operating system...

PT-2026-107240

Name of the Vulnerable Software and Affected Versions yawkat LZ4 Java versions 1.7.0 through 1.11.3 Description The net.jpountz.util.Native.load function creates an exclusive temporary .lck file using File.createTempFile but derives the native-library path by removing the suffix. Subsequently,...

PT-2026-106821

Name of the Vulnerable Software and Affected Versions @quasar/icongenie versions prior to 6.1.1 Description The icongenie generate --profile command fails to constrain the resolved destination to the Quasar project directory when processing folder and name values from a user-supplied profile. The...

PT-2026-107207

An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role...