EUVD-2026-45884

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory...

CVE-2026-12898

The All-in-One WP Migration and Backup WordPress plugin before 7.106 does not properly sanitise a user-supplied value before using it to build a file path, allowing unauthenticated attackers to create or append a log file in arbitrary locations outside its intended storage directory...

CVE-2026-12898

CVE-2026-12898 affects the All-in-One WP Migration and Backup WordPress plugin prior to 7.106. The root cause is improper sanitisation of a user-supplied value used to build a file path, enabling path traversal to create or append a log file in arbitrary locations outside the intended storage dir...

PT-2026-61593

A path traversal vulnerability was found in pulpcore. The relative path validator function only verifies that content paths do not begin with "/" but fails to block directory traversal sequences such as "../" anywhere in the path. An authenticated administrator can craft a relative path containin...

PT-2026-61810

Name of the Vulnerable Software and Affected Versions Astro versions 8.1.0 through 11.0.1 Description When the trailingSlash variable is configured as 'always', the @astrojs/node standalone server's static file handler appends a trailing slash to request paths and issues a 301 redirect. Paths...

IBM Langflow OSS path traversal vulnerability (CNVD-2026-31206)

IBM Langflow OSS is an open-source low-code visualization AI workflow building tool developed by IBM. It enables developers to quickly build, deploy, and iterate AI agents and RAG applications by dragging and dropping components. Additionally, it supports deep customization using Python to...

PT-2026-61719

Name of the Vulnerable Software and Affected Versions Apache MINA SSHD versions 2.18.0 through 2.18.x Apache MINA SSHD versions 3.0.0-M1 through 3.0.0-M4 Description Path traversal on Windows in the sshd-git component of Apache MINA SSHD, a Java library for client-side and server-side SSH. An...

PT-2026-61670

Name of the Vulnerable Software and Affected Versions ExtremeXOS EXOS affected versions not specified Description The mv, cp, and rm file utilities within the shell environment fail to safely canonicalize paths and follow symbolic links outside of the intended privilege boundary. This allows an...

Adobe ColdFusion 2023.x < 2023u22 / 2025.x < 2025u11 Multiple Vulnerabilities (APSB26-82)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2023.x update 22 or 2025.x update 11. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB26-82 advisory. - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal'...

Linux Distros Unpatched Vulnerability : CVE-2026-64033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RDMA/rtrs: Fix use-after-free in path file creation cleanup In the error path of rtrssrvcreatepathfiles, the sysfs root folders may already have been created an...

PT-2026-61646

In the Linux kernel, the following vulnerability has been resolved: i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during concurrent Fuzzing. The crash is caused by an unconditional hardware...

PT-2026-61809

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.0.6 Description A cross-site scripting XSS issue exists when the software is used with an SSR runtime that exposes a global HTMLElement such as Deno, Bun with a DOM shim, or jsdom/happy-dom in Node and a class extendi...

PT-2026-61605

Name of the Vulnerable Software and Affected Versions FileBrowser Quantum versions prior to 1.4.3-beta Description The subtitlesHandler endpoint GET /api/media/subtitles contains path traversal flaws due to insufficient sanitization of the path and name query parameters. The path parameter is...

Cisco ASA/FTD Persistent Local Code Execution (CVE-2024-20359)

A vulnerability in a legacy capability that allowed for the preloading of VPN clients and plugins and that has been available in Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary code wi...

TencentOS Server 3: perl:5.32 (TSSA-2026:0660)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2026:0660 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Important: sssd security update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

ALSA-2026:41937 Important: sssd security update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

Linux Distros Unpatched Vulnerability : CVE-2026-64205

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i2c: i801: fix hardware state machine corruption in error path A severe livelock and subsequent Hung Task panic were observed in the i2c-i801 driver during...

Important: composer

Issue Overview: Composer is a dependency Manager for the PHP language. Prior to 2.2.29 and 2.10.2, a Composer package bin entry containing .. path segments can resolve outside the package install directory and cause Composer's binary installation flow to chmod an existing host file to a...

Medium: credentials-fetcher

Issue Overview: On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open"symlink/"' will open "symlink" even when "symlink" is a symboli...