PT-2026-106789

Name of the Vulnerable Software and Affected Versions Payload versions prior to 3.90.0 Payload versions prior to 4.0.0-canary.34 Payload Postgres packages versions prior to 3.73.0 Description An attacker with read and create or update access to a collection containing a json field or a blocks fie...

PT-2026-107135

On affected versions of CloudVision Portal on-premises or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor...

CVE-2026-106491: Improper Input Validation

Backstage is an open framework for building developer portals. Prior to 0.6.17, the @backstage/plugin-proxy-backend package is affected by improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to ...

Linux Distros Unpatched Vulnerability : CVE-2026-98255

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to th...

PT-2026-106607

In the Linux kernel, the following vulnerability has been resolved: net: remove WARN ON ONCE from the dev fill forward path loop check ipip fill forward path and ip6 tnl fill forward path look up the route to the tunnel's remote endpoint and set ctx-dev to its device, which is the tunnel itself...

TeamViewer Desktop Clients Before 15.81.5 Path Traversal

TeamViewer Desktop Clients before version 15.81.5 contain a path traversal flaw in file transfer that may allow an authenticated remote session participant to write files outside the selected download directory...

PT-2026-107289

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with security IMPORT LOCAL PATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the...

PT-2026-107317

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

CVE-2026-105840: Improper Limitation of a Pathname to a Restricted Directory

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath in src/lrz.c only rejects '../' sequences unless built with...

Brocade Fabric OS path traversal with USB management privileges (CVE-2026-94580)

: An arbitrary file and directory deletion vulnerability exists in the REST API management interface handling USB storage operations on Brocade Fabric OS versions before 10.0.1. An authenticated user possessing USB management privileges can manipulate requested target paths to delete arbitrary...

GHSA-2CV4-CQWR-GWF7 uv: Path traversal on Windows through wheel extraction

Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...

EUVD-2026-91675

uv: Path traversal on Windows through wheel extraction...

uv: Path traversal on Windows through wheel extraction

Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...

GHSA-5639-2J2P-M4MX Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

EUVD-2026-90363

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup...

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

GHSA-2MJX-QC3C-RQVC Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries

Rustls accepted TLS 1.3 handshake messages sent at the wrong encryption level when they followed a key-changing message in the same record. The handshake transcript is still authenticated, so a network-position attacker cannot use this to alter or complete a handshake; the practical effect is tha...

EUVD-2026-91761

Nx: Path traversal in nx migrate package-migrations extraction...

GHSA-HRVQ-X7JP-36XV Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...