PT-2026-104828

Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse entry point def in conda/common/path/python.py accepted an unvalidated entry-point command from a noarch:python package's info/link.json metadata...

CVE-2026-73551: Use of Non-Canonical URL Paths for Authorization Decisions

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

PT-2026-96281

Name of the Vulnerable Software and Affected Versions Joplin versions prior to 3.7.7 Description In Joplin Server instances where TRANSCRIBE ENABLED is set to true, the handlers for the endpoints "/api/transcribe/:id" GET and POST pass the decoded id directly into transcription backend URLs. An...

PT-2026-96237

Name of the Vulnerable Software and Affected Versions Dell Inventory Collector Client versions prior to 15.0.0 Description An unquoted search path or element issue exists where a low privileged attacker with local access could potentially execute code and achieve elevation of privileges...

PT-2026-96320

Name of the Vulnerable Software and Affected Versions OctoPrint version 1.0.0 Description A path traversal issue exists in the File Download API component within the validate function of the src/octoprint/server/api/files.py file. A remote attacker can manipulate the filename argument to access...

PT-2026-96035

Name of the Vulnerable Software and Affected Versions nvm versions prior to 0.40.8 Description The nvm alias function fails to perform a containment check when concatenating a requested version or alias name to the $NVM DIR/alias directory. This allows a name containing .. components to escape th...

PT-2026-96166

Name of the Vulnerable Software and Affected Versions KubeEdge versions 1.16.0 through 1.21.1 KubeEdge versions 1.22.0 through 1.22.1 KubeEdge versions 1.23.0 Description The DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go fails to sufficiently validate archive entry names when...

PT-2026-96154

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.106.1 Description The WorkerStatus gRPC polling path in pkg/repository/durable events.go passes caller-supplied durable task, node, and branch identifiers to the ListSatisfiedEntries function without applying a tena...

CVE-2026-73553: Interpretation Conflict

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

CVE-2026-73553: Interpretation Conflict

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

CVE-2026-73553: Interpretation Conflict

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, When ignorepathparametersinpathmatching is enabled, Envoy's router strips the semicolon suffix before matching but the RBAC urlpath matcher evaluates the raw path. ...

PT-2026-110771

Name of the Vulnerable Software and Affected Versions LibreNMS versions prior to 26.9.0 Description A path traversal issue exists in the nfsen channel common.inc.php file. Authenticated users can read unauthorized RRD Round Robin Database data by injecting ../ sequences into the channel parameter...

EulerOS Virtualization 2.10.1 : python-pip (EulerOS-SA-2026-3849)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...

CVE-2026-62369: Improper Limitation of a Pathname to a Restricted Directory

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.16.0 until 1.21.2, 1.22.2, and 1.23.1, the DecompressTarGz function in keadm/cmd/keadm/app/cmd/util/common.go joins archive entry names to the extraction destinatio...

CVE-2026-73551: Use of Non-Canonical URL Paths for Authorization Decisions

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefor...

PT-2026-96150

Name of the Vulnerable Software and Affected Versions draw.io versions prior to 30.2.7 Description The ExportProxyServlet.java component uses request.getPathInfo to construct a proxyPath which is appended to the EXPORT URL. Because the application fails to reject dot segments or verify that the...

CVE-2026-54584: External Control of File Name or Path

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to a...

CVE-2026-63416: Improper Limitation of a Pathname to a Restricted Directory

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, src/main/java/com/mxgraph/online/ExportProxyServlet.java uses request.getPathInfo to build a proxyPath and appends it directly to EXPORTURL without rejecting dot segments or confirming that the normalize...

ROS-20260921-73-0105

The vulnerability in perl-HTTP-Daemon is related to improper external management of file names or paths. Exploiting this vulnerability can allow an attacker to increase their privileges...

EulerOS Virtualization 2.10.1 : perl-Archive-Tar (EulerOS-SA-2026-3845)

According to the versions of the perl-Archive-Tar packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction...