The vulnerability of the automatic software update mechanism of the ViPNet Client 4 system, related to deficiencies in handling relative paths, allows a malicious intruder from a neighboring trusted network to compromise the integrity of the operating environment. This vulnerability enables the intruder to gain privileges in the attacked node’s system and execute arbitrary code using a specially crafted update package sent from a compromised network node with the role of a network management center.

The vulnerability of the automatic software update mechanism of the ViPNet Client 4 lies in the deficiencies in the handling of relative paths. Exploiting this vulnerability can allow a perpetrator operating from a neighboring trusted network to compromise the integrity of the operating...

CVE-2025-45870

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion LFI in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories...

Linux Distros Unpatched Vulnerability : CVE-2026-59732

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.74.4, rclone archive extract can write...

PT-2026-60682

Name of the Vulnerable Software and Affected Versions kuma-dp versions 2.8.0 through 2.9.15 Description When kuma-dp is started against an HTTPS control plane without a CA certificate, the data plane connects with TLS peer verification disabled. This causes the dataplane authentication token to b...

openSUSE 16 Security Update : python-mistune (openSUSE-SU-2026:21339-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21339-1 advisory. This update for python-mistune fixes the following issues - CVE-2026-59922: quadratic-time parsing on long runs of some markers in formatting.py...

Notepad++ < 8.9.7 Multiple Vulnerabilities

The version of Notepad++ installed on the remote host is prior to 8.9.7. It is, therefore, affected by multiple vulnerabilities: - A security bypass vulnerability exists in session.xml backupFilePath handling due to an incomplete startswith check. An attacker could exploit this to bypass path...

JetBrains IntelliJ IDEA < 2026.1.4 Code Execution via Path Traversal (CVE-2026-59792)

The version of JetBrains IntelliJ IDEA installed on the remote host is prior to 2026.1.4. It is, therefore, affected by a code execution vulnerability: - Code execution via path traversal in project workspace ID handling was possible. CVE-2026-59792 Note that Nessus has not tested for this issue...

CVE-2025-45870

LogicalDOC Enterprise (up to v9.1.1) is reported vulnerable to Local File Inclusion via the OnlyOfficeEditor servlet, where authenticated users can exploit a path traversal flaw in the fileExt parameter to access files outside designated directories. The available documents consistently describe ...

Linux Distros Unpatched Vulnerability : CVE-2026-54058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap raw codec path,...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1930)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1930 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

Linux Distros Unpatched Vulnerability : CVE-2026-8384

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected:...

PT-2026-60482

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota, an OpenAPI based HTTP Client code generator, fails to validate outputPath values for clients and plugins within the .kiota/workspace.json configuration file. This allows a malicious repository ...

SUSE SLES15: libipa_hbac-devel / libipa_hbac0 / libsss_certmap-devel / etc (SUSE-SU-2026:3025-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3025-1 advisory. This update for sssd fixes the following issues - CVE-2026-14474: sudo LDAP provider searches entire directory tree for sudoRole...

PT-2026-60610

Wazuh is a free and open source platform used for threat prevention, detection, and response. Versions 4.6.0 and above prior to 4.14.5 contain a heap-based buffer overflow vulnerability in the syscheck component of the Wazuh agent for Windows. When expanding registry paths containing wildcards or...

PT-2026-60489

Name of the Vulnerable Software and Affected Versions Kiota versions prior to 1.32.5 Description Kiota is an OpenAPI based HTTP Client code generator. The kiota plugin add and kiota plugin generate using the -t APIPlugin flag functions fail to validate paths in static template.file values sourced...

EUVD-2025-210478

LogicalDOC Enterprise up to and for v9.1.1 is vulnerable to Local File Inclusion LFI in the OnlyOfficeEditor servlet class, allowing authenticated user to exploit path traversal flaws in the fileExt parameter, enabling unauthorized access to sensitive files outside the designated directories...

PT-2026-60600

Name of the Vulnerable Software and Affected Versions Quicly versions prior to commit dccf5d4 Description Quicly, an IETF QUIC protocol implementation used in the H2O HTTP server, is susceptible to stateless reset injection. The issue stems from a lack of packet entry validation when handling...

wireshark security update

4.4.2-10.0.1 - Fix post script to not fail during initial installation Orabug: 37565359 1:4.4.2-10 - Resolves: RHEL-173221 - CVE-2026-5656 Improper Limitation of a Pathname to a Restricted Directory 1:4.4.2-9 - Resolves: RHEL-173218 - CVE-2026-5405 Heap-based Buffer Overflow 1:4.4.2-8 - Resolves:...

flatpak security update

1.16.0-9.1 - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157...

NPM: systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

NPM: systeminformation: OS command injection in networkInterfaces via interfaces5 source-directive path on Linux vulnerability discovered by ? in WordPress Npm systeminformation versions = 5.31.6...