CVE-2026-97434: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's netdevice but shared by all ports. The NAPI instances get disabled only once the last port goe...

CVE-2026-77825: Improper Limitation of a Pathname to a Restricted Directory

IBM ContextForge MCP Gateway 1.0.0 through 1.0.8 was vulnerable to path traversal in its Admin API log-download endpoint GET /v1/admin/logs/file. The path confinement check uses str.startswith rather than proper boundary validation, allowing an authenticated admin to read .log, .jsonl, and .json...

PT-2026-97837

Name of the Vulnerable Software and Affected Versions IBM ContextForge MCP Gateway versions 1.0.0 through 1.0.8 Description An authenticated administrator can perform path traversal via the Admin API log-download endpoint GET /v1/admin/logs/file. The issue occurs because the path confinement chec...

CVE-2026-91123: Improper Limitation of a Pathname to a Restricted Directory

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser...

CVE-2026-88373

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...

PT-2026-98237

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description The public avatar and logo image endpoint allows an unauthenticated attacker to provide controlled fileName path segments. Because these segments are resolved against local storage without being...

Security update for ant (important)

openSUSE security update: security update for ant ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21891-1 Rating: important References: bsc1188469 bsc1246873 bsc1280015 Cross-References: CVE-2021-36374 CVE-2025-7962 CVE-2026-78254 CVSS scores:...

Linux Distros Unpatched Vulnerability : CVE-2026-97436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dpaa2-switch: rework FDB management on the bridge leave path On bridge leave, the dpaa2switchportsetfdb function always allocates a new FDB for the port which i...

RockyLinux 8 : tar (RLSA-2026:70390)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:70390 advisory. tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X'...

RHCOS 4 : OpenShift Container Platform 4.14.74 (RHSA-2026:67836)

The remote Red Hat Enterprise Linux CoreOS 4 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:67836 advisory. - github.com/cri-o/cri-o: Fix Bypass for CVE-2022-4318 /etc/passwd Injection via HOME env CVE-2026-15809 -...

Linux Distros Unpatched Vulnerability : CVE-2026-97434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's netdevice but shared by a...

CVE-2026-82708: Improper Limitation of a Pathname to a Restricted Directory

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could submit a crafted request to access files within the device's removable storage that were not intended to be directly accessible through the...

CVE-2026-97232: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function getfilecontent/savefilecontent/movefiles/startstreaming of the file page.html. This manipulation causes path traversal. The attack can be initiated remotely. The exploit has been...

PT-2026-104888

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add validation for node in acpi ns build normalized path Add validation for node in acpi ns build normalized path to prevent use-after-free vulnerabilities...

PT-2026-98082

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the ACPICA component of the Linux kernel. The problem occurs due to a lack of validation for the node in the acpi ns build normalized path function, whic...

CVE-2026-97436: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: rework FDB management on the bridge leave path On bridge leave, the dpaa2switchportsetfdb function always allocates a new FDB for the port which is becoming standalone. In case no FDB is found, then the port leaving...

CVE-2026-88373

The libde265 library (commit 4d45a6b ) contains a NULL pointer dereference vulnerability within the NAL parsing path. When the de265_push_NAL() function is invoked with a zero-length NAL unit, it may produce a NAL_unit with a NULL backing buffer . This buffer is then used as the destination argum...

PT-2026-98207

Name of the Vulnerable Software and Affected Versions volotat Anagnorisis versions prior to 0.4.12 Description Cross site scripting occurs in the Media Filename Handler component due to improper handling of the file path argument within the html function of the PlaylistManager.js file. This allow...

CVE-2026-97360: Missing Authorization

HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside the shared folder. Attackers can exploit the macro...

CVE-2026-19532: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: from 2.3.2 before 2.3.4-1124...