PT-2026-102746

rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...

CVE-2026-90915: Improper Limitation of a Pathname to a Restricted Directory

Joomla! Core - 20260905 - Core - Arbitrary directory deletion via cache purge action in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 -An improper validation of the cache group name allowed path traverals in the file storage of the caching layer, resulting in arbitrary directory deletions...

PT-2026-108598

Security vulnerability affects the argo-workflows package. path-to-regexp turns path strings into a regular expressions...

PT-2026-102731

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignore path parameters in path matching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC url path matcher evaluates the raw...

CVE-2026-8066: Relative Path Traversal

A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in...

PT-2026-102891

VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt skin archives. Attackers can craft malicious skin files with path traversal sequences to write arbitrary files with VLC user privileges, enabling code...

CVE-2026-101126: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - balbooa.com - File meta data tampering in Balbooa Forms 2.4.3.4 - The final form submission processes JSON arrays per upload field, checking only that IDs are numeric. Client-supplied filenames and display names are trusted directly, introducing potential cross-session claiming...

Linux Distros Unpatched Vulnerability : CVE-2026-86334

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows...

Linux Distros Unpatched Vulnerability : CVE-2026-85185

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated...

Linux Distros Unpatched Vulnerability : CVE-2026-97023

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of...

Linux Distros Unpatched Vulnerability : CVE-2026-87799

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper link resolution in the migration receive path in Canonical LXD versions 4.0 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an...

Linux Distros Unpatched Vulnerability : CVE-2026-97024

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host syste...

Amazon Linux 2023 : composer (ALAS2023-2026-3136)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3136 advisory. Package bin path can escape the package directory, bypassing the GHSA-gjfg-22fp-rrxx fix. A malicious or compromised Composer package could, when installed as a dependency, cause Composer to...

Linux Distros Unpatched Vulnerability : CVE-2024-58386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The...

Amazon Linux 2023 : rclone (ALAS2023-2026-3129)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3129 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

CVE-2026-102424: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - balbooa.com - Unauthenticated path traversal exfiltrates local files through auto-reply attachments in Balbooa Forms 2.4.3.4 - Balbooa Forms accepts upload-field state as Guest-controlled JSON during public form submission. For every object whose id merely looks numeric, the...

SUSE CVE-2026-44948

A path traversal vulnerability was found in Fleet's ImageScan subsystem in Rancher Fleet 0.12.0 up to 0.12.16, 0.13.0 up to 0.13.12, 0.14.0 up to 0.14.7 and 0.15.0 up to 0.15.3 could be used to traverse outside of the intended directory, causing a denial of service...

SUSE CVE-2026-100419

gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to escape the worktree directory via symlink manipulation. During forced checkout with overwriteexisting enabled, attackers can craft malicious repository trees...

SUSE CVE-2026-100689

GitPython before 3.1.62 does not validate the path field read from an untrusted .gitmodules file when updating submodules. While a prior fix GHSA-hmq2-w58f-27jc added Submodule.validatedname to constrain the name field, and GitPython's own containment guard Submodule.torelativepath is applied in...

CVE-2026-102332

Dozzle versions before 11.1.2 fail to sanitize container display names when building ZIP archive entry names in the log download endpoint. Attackers who can label containers can use path traversal sequences to write files outside the extraction directory when users download and extract logs...