144476 matches found
PT-2026-104888
In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add validation for node in acpi ns build normalized path Add validation for node in acpi ns build normalized path to prevent use-after-free vulnerabilities...
ALSA-2026:71658 Important: python-cryptography security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
Linux Distros Unpatched Vulnerability : CVE-2026-97496
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly fro...
OllamaDrama: Designing and Deploying a Honeypot to Measure Attacks on Exposed LLM Infrastructure
Publicly exposed large language model LLM infrastructure creates a growing attack surface, yet real-world targeting remains poorly understood. We present Ollure, a low- and medium-interaction honeypot that emulates the Ollama API without a backend LLM. Spanning four deployments across cloud and...
CVE-2026-97434
In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's netdevice but shared by all ports. The NAPI instances get disabled only once the last port goe...
PT-2026-98070
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the dpaa2-switch component regarding Forwarding Database FDB management during the bridge leave path. The dpaa2 switch port set fdb function always attempts to allocat...
PT-2026-98237
Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.80.1 Description The public avatar and logo image endpoint allows an unauthenticated attacker to provide controlled fileName path segments. Because these segments are resolved against local storage without being...
PT-2026-105619
filtering for broadcast messages bypassing path/interface/member checks...
CVE-2026-91123: Improper Limitation of a Pathname to a Restricted Directory
Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could therefore pass an allowediframes subpath check while browser...
CVE-2026-96884: Improper Limitation of a Pathname to a Restricted Directory
A security flaw has been discovered in MantisZip up to 0.4.5. Affected by this issue is the function Path.Combine of the file MainWindow.UI.cs of the component Preview. The manipulation results in path traversal. It is possible to launch the attack remotely. The exploit has been released to the...
CVE-2026-88384
OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-type attribute with dataSize set to zero causes the parser to create an opaque attribute with a NULL packeddata pointer. The OpaqueAttribute constructor passes...
CVE-2026-88373
libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265pushNAL is called with a zero-length NAL unit, the resulting NALunit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy in NALunit::setdat...
CVE-2026-96762: Authorization Bypass Through User-Controlled Key
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument clientid/segmentid causes authorization bypass. Remote exploitation of the attack is possible. The exploit...
PT-2026-97860
Name of the Vulnerable Software and Affected Versions LaSuite Doc versions 4.8.2 through 5.3.x Description An issue exists in the collaborative note taking, wiki, and documentation platform where the endpoint "/api/v1.0/documents/search/" accepts sequential seven-digit document paths to scope...
WSO2 Multiple Products Path Traversal Vulnerability
WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...
PT-2026-97694
Name of the Vulnerable Software and Affected Versions MantisZip versions prior to 0.4.6 Description A path traversal flaw exists in the Preview component within the MainWindow.UI.cs file. The issue occurs in the Path.Combine function, allowing a remote attacker to manipulate file paths to access...
PT-2026-97700
Name of the Vulnerable Software and Affected Versions ShopXO versions prior to 2.2.8 Description A path traversal issue exists in the Ueditor Upload Interface component within the config/ueditor.php file. A remote attacker can exploit this by manipulating the path type argument, allowing them to...
PT-2026-98278
Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The HTTP server in the firmware contains a path traversal flaw. This allows an attacker connected to the device WiFi network to send a specially crafted request to access files on the...
Security update for ant (important)
openSUSE security update: security update for ant ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21891-1 Rating: important References: bsc1188469 bsc1246873 bsc1280015 Cross-References: CVE-2021-36374 CVE-2025-7962 CVE-2026-78254 CVSS scores:...
CVE-2026-96762 kvcache-ai mooncake RPC Path UnmountSegment authorization
A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component RPC Path Handler. This manipulation of the argument clientid/segmentid causes authorization bypass. Remote exploitation of the attack is possible. The exploit...