Erlang/OTP -- relative path traversal in the zip module

The Erlang/OTP team reports: Fixed a bug where zip:unzip/1,2 and zip:extract/1,2 were vulnerable to a relative path traversal attack. A crafted zip archive containing entry names such as ../x/y could have caused files to be written outside the intended extraction directory...

About the security content of macOS Tahoe 26.6

About the security content of macOS Tahoe 26.6 This document describes the security content of macOS Tahoe 26.6. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are...

About the security content of macOS Sonoma 14.8.8

About the security content of macOS Sonoma 14.8.8 This document describes the security content of macOS Sonoma 14.8.8. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or release...

UBUNTU-CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

PT-2026-65109

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path validation weakness in archive extraction and write handling allows entries containing traversal sequences to be written outside the intended build...

Erlang/OTP -- denial of service via exponential certificate policy tree growth

https://github.com/erlang/otp/security/advisories/GHSA-622p-qfh6-c352 reports: A remote attacker can trigger a denial of service through TLS certificate handling. By sending a specially crafted certificate chain with multiple certificate policies at each level, the policy tree expands exponential...

PT-2026-64979

Relative Path Traversal vulnerability in Erlang OTP stdlib zip module allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check dir level/2, which tracks directory depth as a running integer...

PT-2026-65264

A path handling issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.8, macOS Tahoe 26.6. A malicious app may be able to break out of its sandbox...

Telerik UI for ASP.NET AJAX < 2026.2.708 Multiple Vulnerabilities

The version of Telerik UI for ASP.NET AJAX installed on the remote Windows host is prior to 2026.2.708. It is, therefore, affected by multiple vulnerabilities: - In Progress Telerik UI for AJAX prior to v2026.2.708, applications using cookie-based storage in RadPersistenceManager or RadDockLayout...

PT-2026-65176

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description A path traversal issue exists where an app may be able to break out of its sandbox. This occurs due to insufficient inp...

PT-2026-64998

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.6 Description Authenticated attackers can delete arbitrary files due to insufficient sanitization of path traversal sequences in the existing image field during category updates. This issue occurs within the...

PT-2026-65157

Name of the Vulnerable Software and Affected Versions macOS Sequoia versions prior to 15.7.8 macOS Sonoma versions prior to 14.8.8 macOS Tahoe versions prior to 26.6 Description A parsing issue in the handling of directory paths exists where improved path validation is required. This flaw could...

PT-2026-64959

Name of the Vulnerable Software and Affected Versions NitroShare Desktop versions prior to 0.3.5 Description The LAN file transfer server contains a path traversal issue that allows unauthenticated attackers on the same network to write arbitrary files. This occurs because the server fails to...

UBUNTU-CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

CVE-2026-64242

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: net2280: Fix double free in probe error path usbinitializegadget installs gadgetrelease as the release callback for the embedded gadget device. The struct net2280 instance is therefore released through gadgetrelease...

About the security content of macOS Sequoia 15.7.8

About the security content of macOS Sequoia 15.7.8 This document describes the security content of macOS Sequoia 15.7.8. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

UBUNTU-CVE-2026-64226

In the Linux kernel, the following vulnerability has been resolved: schedext: Avoid UAF in scxrootenableworkfn init failure path In scxrootenableworkfn, puttaskstructp is called before scxerror dereferences p-comm and p-pid. If the iterator's reference is the last drop, the task is freed...

SUSE CVE-2026-42955

In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other...

nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation

A flaw was found in Node.js. This vulnerability allows a bypass of the Permission Model enforcement due to path misvalidation within the process.report.writeReport function. An attacker could exploit this to bypass intended security boundaries, potentially leading to unauthorized access to...

Arbitrary Code Injection

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Arbitrary Code Injection via the customBasePath schema field. An attacker can execute arbitrary Python code by supplying a specially crafted value containing embedded newlines and a...