RHEL 10 : python-cryptography (RHSA-2026:71659)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:71659 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

Linux Distros Unpatched Vulnerability : CVE-2026-67224

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as...

RHEL 10 : python-cryptography (RHSA-2026:71658)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:71658 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git-lfs (UTSA-2026-124485)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-124485 advisory. If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath , ., and .., can result in th...

CVE-2026-90959: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'fileurl' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a string prefix comparison that only rejects...

CVE-2026-78312: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022...

CVE-2026-88843: Improper Limitation of a Pathname to a Restricted Directory

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not validate one of its display-style settings before using it to build a template path, allowing users with the Contributor role and above to include and execute arbitrary local PHP files on the server. An equivalent path w...

PT-2026-97733

Name of the Vulnerable Software and Affected Versions DIAEnergie versions prior to 1.11.00.022 Description Path Traversal in DIAEnergie. Path Traversal is a vulnerability that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables...

PT-2026-97723

Name of the Vulnerable Software and Affected Versions PaperCut NG affected versions not specified PaperCut MF affected versions not specified Description A path traversal issue exists in the Scan-to-Fax component, where improper limitation of a pathname to a restricted directory allows an...

PT-2026-97788

Name of the Vulnerable Software and Affected Versions Liman MYS versions 2.3.2 through 2.3.4-1123 Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows unauthorized access to files or directories outside the intended folder. Recommendations...

PT-2026-98257

Name of the Vulnerable Software and Affected Versions Rapid7 Insight Agent affected versions not specified Description An uncontrolled search path element in InsightVM assessment content on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM. This occurs because a chec...

CVE-2026-48072: Improper Limitation of a Pathname to a Restricted Directory

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, the public avatar and logo image endpoint accepts attacker-controlled fileName path segments and resolves them against local storage without confinement to the intended image directory. An unauthenticated...

PT-2026-98070

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dpaa2-switch component regarding Forwarding Database FDB management during the bridge leave path. The dpaa2 switch port set fdb function always attempts to allocat...

CVE-2026-81547: Improper Limitation of a Pathname to a Restricted Directory

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary commands due to path traversal...

PT-2026-97841

Name of the Vulnerable Software and Affected Versions IBM DataStage on Cloud Pak for Data version 5.4.0.0 Description A path traversal issue allows a remote authenticated attacker to execute arbitrary commands. Path traversal is a flaw that allows an attacker to access files and directories that...

PT-2026-97860

Name of the Vulnerable Software and Affected Versions LaSuite Doc versions 4.8.2 through 5.3.x Description An issue exists in the collaborative note taking, wiki, and documentation platform where the endpoint "/api/v1.0/documents/search/" accepts sequential seven-digit document paths to scope...

PT-2026-104867

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's net device but shared by all ports. The NAPI instances get disabled only once the last port go...

CVE-2026-96898: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in yhx070424 ShopXO up to 2.2.7. Affected by this vulnerability is an unknown functionality of the file config/ueditor.php of the component Ueditor Upload Interface. The manipulation of the argument pathtype results in path traversal. It is possible to launch the atta...

PT-2026-97694

Name of the Vulnerable Software and Affected Versions MantisZip versions prior to 0.4.6 Description A path traversal flaw exists in the Preview component within the MainWindow.UI.cs file. The issue occurs in the Path.Combine function, allowing a remote attacker to manipulate file paths to access...

CVE-2026-93225: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phy: fsl-imx8mq-usb: fix typec switch leak on probe error path If probe fails after imx95usbphygettca succeeds, the typec switch leaks because the only cleanup path was in .remove, which never runs on probe failure. Use...