CVE-2026-104871: Improper Limitation of a Pathname to a Restricted Directory

The Angular SSR is a server-rise rendering tool for Angular applications. Prior to versions 20.3.36, 21.2.23, and 22.1.7, the CommonEngine retrieveSSGPage prerendered-page retrieval logic in @angular/ssr/node, and in @angular/ssr for versions 17 through 18, accepts a relative request URL containi...

SUSE SLES16 Security Update : php-composer2 (SUSE-SU-2026:23943-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23943-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has...

Fedora 44 : sos (2026-594e78463a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-594e78463a advisory. Security fix for CVE-2026-79655 Fixes a path traversal vulnerability in sos clean tar extraction where unvalidated symlink and hardlink targets could lead to...

PT-2026-104330

Name of the Vulnerable Software and Affected Versions Logback-classic versions 0.9.14 through 1.6.4 Description A path-traversal issue exists in the logback-classic module. An MDC-based discriminator value is passed unsanitized into a nested FileAppender path. An attacker who can influence this M...

EUVD-2026-91700

In TaskingAI v0.3.0 in the QR Code Generator plugin savebase64image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the projectid parameter...

CVE-2026-51907

In TaskingAI v0.3.0 in the QR Code Generator plugin savebase64image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the projectid parameter...

PT-2026-104366

Name of the Vulnerable Software and Affected Versions TaskingAI version 0.3.0 Description In the DALL-E 3 image generation tool, the save url image function contains a path traversal flaw. This allows attackers to write downloaded images to arbitrary locations on the server filesystem by...

CVE-2014-125130: Improper Limitation of a Pathname to a Restricted Directory

CodeArt Google MP3 Audio Player plugin google-mp3-audio-player for WordPress through 1.0.11 contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to retrieve sensitive files by supplying a path-traversal payload in the file parameter of directdownload.php...

Linux Distros Unpatched Vulnerability : CVE-2026-104721

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java logback-classic module allows path- traversal vulnerability. More specifically, an MDC-based...

CVE-2026-51906

A path traversal vulnerability exists in TaskingAI v0.3.0 within the DALL-E 3 image generation tool's save_url_image function. By manipulating the project_id parameter, an attacker can force the application to write downloaded images to arbitrary locations on the server filesystem. Technical deta...

CVE-2026-51907

A path traversal vulnerability exists in TaskingAI v0.3.0 within the QR Code Generator plugin . Specifically, the save_base64_image function fails to properly sanitize the project_id parameter, allowing an attacker to write image files to arbitrary locations on the server filesystem. While exploi...

openSUSE 16 Security Update : rclone (openSUSE-SU-2026:21999-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21999-1 advisory. Changes in rclone: - Update to version 1.75.1: boo1279548 - Security - archive - Fix zip slip path traversal in untrusted zip files...

AlmaLinux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790925399)

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790925399 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell...

openSUSE 16 Security Update : php-composer2 (openSUSE-SU-2026:21970-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21970-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has extracted the...

PaperCut MF < 25.0.13 / 26.x < 26.0.5 Multiple Vulnerabilities

The version of PaperCut MF installed on the remote Windows host is prior to 25.0.13, or 26.x prior to 26.0.5. It is, therefore, affected by the following vulnerabilities: - An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of...

Fedora 45 : wordpress (2026-c7024b3255)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-c7024b3255 advisory. WordPress 7.1.2 Security Release Security updates included in this release - Unauthenticated path traversal in page-template resolution leading to conditiona...

Linux Distros Unpatched Vulnerability : CVE-2026-86345

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an...

Rocky Linux 8 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource Multiple Vulnerabilities (crlsa-2026_74095)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202674095 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: Arbitrary file deletion via malicious file lis...

CVE-2026-104843: Improper Limitation of a Pathname to a Restricted Directory

uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows...

PT-2026-104357

Name of the Vulnerable Software and Affected Versions uv versions 0.12.7 through 0.12.17 Description On Windows, the wheel extraction process can be manipulated by a malicious wheel to write files outside the intended installation prefix. This allows for the placement of an executable file into a...