GHSA-Q67Q-549Q-P849

creationtimestamp| type| source ---|---|--- 2026-08-10 17:18:10+00:00| seen| https://gist.github.com/haidang-infosec/402db84bee7aca2f57bb109b31574649...

CVE-2026-47754

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint that is part of the original 1.x Metacat API...

CVE-2026-47754

CVE-2026-47754 affects Metacat 2.x (including 2.19.1) and all 1.x versions, with an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint. The bug stems from ArchiveHandler.readArchiveEntry() concatenating user input into a filesystem path and a disabled has...

EUVD-2026-55673

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint that is part of the original 1.x Metacat API...

CVE-2026-47754 unauthenticated path traversal in Metacat 2.x

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint that is part of the original 1.x Metacat API...

CVE-2026-47754 unauthenticated path traversal in Metacat 2.x

Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the archiveEntryName parameter of the action=read endpoint that is part of the original 1.x Metacat API...

CVE-2026-18412

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

EUVD-2026-55652

OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extensio...

SUSE-SU-2026:3548-1 Security update for python311

This update for python311 fixes the following issues: Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when the configparser module is used bsc1269066. - CVE-2026-3276: quadratic complexity in unicodedata.normalize can le...

AZL-95646 CVE-2026-15059 affecting package systemd-bootstrap 250.3-19

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

DEBIAN-CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

AZL-95640 CVE-2026-15059 affecting package systemd 255-33

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

CVE-2026-15059 systemd-oomd: unprivileged users can terminate arbitrary processes

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

EUVD-2026-55625

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

CVE-2026-15059

The CVE concerns systemd-oomd, where local unprivileged users can terminate arbitrary local processes via the systemd-oomd IPC API due to missing path traversal validation. Affected component: systemd-oomd IPC interface; root cause: lack of validation on paths in IPC calls. Impact: potential for ...

CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

AZL-95225 CVE-2026-68083 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...

CVE-2026-68083

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix path resolution in ksmbdvfskernpathcreate The SMB2 open lookup is rooted at the share with LOOKUPBENEATH, but the create/mkdir/hardlink sink is not: ksmbdvfskernpathcreate builds an absolute path with converttounixname...