Arbitrary File Write via Path Traversal during Support Bundle Extraction in Brocade ASCG before 3.5.0 (CVE-2026-85490)

When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting...

Unauthenticated path traversal vulnerability exists in the Brocade ASCG (CVE-2026-85487)

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

PT-2026-104228

Name of the Vulnerable Software and Affected Versions Ghost versions 1.20.0 through 6.63.x Description A path traversal issue exists in the theme translation file loading process. This allows authenticated administrators to read JSON files located outside the active theme directory by manipulatin...

SUSE SLES16 Security Update : php-composer2 (SUSE-SU-2026:23943-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:23943-1 advisory. - CVE-2026-59944: path traversal and link following issue can make files world readable and executable bsc1279898. Tenable has...

Linux Distros Unpatched Vulnerability : CVE-2026-79768

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directiv...

Fedora 44 : sos (2026-594e78463a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-594e78463a advisory. Security fix for CVE-2026-79655 Fixes a path traversal vulnerability in sos clean tar extraction where unvalidated symlink and hardlink targets could lead to...

PaperCut NG < 25.0.13 / 26.x < 26.0.5 Multiple Vulnerabilities

The version of PaperCut NG installed on the remote Windows host is prior to 25.0.13, or 26.x prior to 26.0.5. It is, therefore, affected by the following vulnerabilities: - An improper limitation of a pathname to a restricted directory path traversal vulnerability in the Scan-to-Fax component of...

SUSE SLED15: kpartx / libdmmp-devel / libdmmp0_2_0 / libmpath0 / multipath-tools / etc (SUSE-SU-2026:4406-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4406-1 advisory. - Heap Out-of-Bounds Read in Custom Format String Parser via Trailing % bsc1277205. - Path traversal in...

Rocky Linux 9.6 [TuxCare] Security Update: rsync / rsync-daemon / rsync-rrsync Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790925399)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790925399 advisory. - rsync before 3.5.0 contains a time-of-check to time-of-use TOCTOU race condition vulnerability in the rrsync restricted shell...

Rocky Linux 8 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource Multiple Vulnerabilities (crlsa-2026_74095)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202674095 advisory. rsync: rsync 2.3.3 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink CVE-2026-70460 rsync: rsync: Arbitrary file deletion via malicious file lis...

CVE-2026-86345

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2026-86345 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2026-86345 389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

CVE-2025-71427

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse savepresentation,...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

CVE-2025-71427 Office-PowerPoint-MCP-Server through 2.0.7 Path Traversal via save_presentation and manage_image

Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse savepresentation,...

CVE-2025-71427

The Office-PowerPoint-MCP-Server (versions prior to 2.0.8 ) is vulnerable to a path traversal flaw. This vulnerability allows MCP callers to read and write files outside the intended working directory by providing absolute paths or ../ sequences. An attacker can leverage prompt injection to manip...