CVE-2026-103278: Relative Path Traversal

Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...

CVE-2026-103255: External Control of File Name or Path

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...

PT-2026-103787

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the signed resume URL generation for Send-and-Wait approvals. Users with workflow creation permissions can forge...

PT-2026-103790

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103254: Improper Limitation of a Pathname to a Restricted Directory

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...

CVE-2026-103257: Improper Limitation of a Pathname to a Restricted Directory

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...

CVE-2026-103263: Improper Link Resolution Before File Access

Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static directory exists inside it, unauthenticated attackers can request...

PT-2026-105805

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

CVE-2026-51882

The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...

CVE-2026-51884

The Langchain Chatchat 0.3.1 software contains a path traversal vulnerability in the /knowledge_base/upload_temp_docs temporary document upload endpoint. An attacker can exploit this by crafting malicious filenames to write files to arbitrary locations on the server, effectively bypassing intende...

PT-2026-105517

Summary /api/file/getUniqueFilename takes a path from the request body and passes it to a filesystem existence check with no validation, confinement or authorization. The response distinguishes paths that exist from paths that do not, so an anonymous reader in publish mode can probe arbitrary...

PT-2026-105583

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...

ROS-20261001-73-0023

The vulnerability in glib2 relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

Rocky Linux 9 [CIQ] Security Update: rsync / rsync-daemon / rsync-debuginfo / rsync-debugsource / etc Multiple Vulnerabilities (crlsa-2025_7050)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20257050 advisory. rsync: Path traversal vulnerability in rsync CVE-2024-12087 rsync: --safe-links option bypass leads to path traversal CVE-2024-12088 rsync: Race Condition ...

Rocky Linux 8 [CIQ] Security Update: vim-X11 / vim-X11-debuginfo / vim-common / vim-common-debuginfo / etc (crlsa-2026_22730)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202622730 advisory. vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass CVE-2026-35177 Tenable has extracted the preceding description block directly...

Check Point Gaia Operating System (sk1000171)

The remote host is missing a hotfix for the Gaia Operating System. It is, therefore, affected by a vulnerability as referenced in the sk1000171 advisory. - A path traversal and arbitrary file upload vulnerability in Check Point Security Management Server, Multi-Domain Security Management Server,...

Rocky Linux 10.2 [CIQ] Security Update: iscsi-initiator-utils / iscsi-initiator-utils-debuginfo / etc Multiple Vulnerabilities (crlsa-2026_53845)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202653845 advisory. open-iscsi: open-iscsi: Authentication bypass in iscsiuio control socket CVE-2026-44944 open-iscsi: open-iscsi: Privilege Escalation via Path Traversal...

Rocky Linux 10.2 [CIQ] Security Update: flatpak / flatpak-debuginfo / flatpak-debugsource / flatpak-devel / etc Multiple Vulnerabilities (crlsa-2026_21757)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202621757 advisory. flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options CVE-2026-34078 flatpak: Flatpak: Arbitrary file deletion on...

Rocky Linux 10.0 [CIQ] Security Update: python3-setuptools / python3-setuptools-wheel (crlsa-2025_9940)

The Rocky Linux 10.0 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20259940 advisory. setuptools: Path Traversal Vulnerability in setuptools PackageIndex CVE-2025-47273 Tenable has extracted the preceding description block directly from the CIQ...

Rocky Linux 9 [CIQ] Security Update: perl-Archive-Tar (crlsa-2026_30856)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202630856 advisory. perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 Tenable has extracted the preceding description...