CVE-2026-85272: Improper Limitation of a Pathname to a Restricted Directory

Open edX Platform enables the authoring and delivery of online learning at any scale. From Aspen.1 until Ulmo and Verawood.1, openedx/core/lib/extractarchive.py uses isbadpath to validate safeextractall targets by comparing resolved path strings with startswith instead of comparing path component...

CVE-2026-57223: Unquoted Search Path or Element

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...

CVE-2026-93751: Improper Handling of Unicode Encoding

uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars that decodes invalid and overlong percent-encoded sequences into ASCII metacharacters. Attackers can craft percent-encoded payloads to bypass platform decoder validation and inject path traversal or CRLF sequenc...

CVE-2026-62278: Improper Limitation of a Pathname to a Restricted Directory

LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, authenticated non-administrative users could reach HandleTranslationFileUpload and influence the name passed from Controllers/FilesController.cs to RenameFile in Helper/FileHelper.cs...

CVE-2026-93504: Improper Access Control

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...

CVE-2026-93468: Relative Path Traversal

The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files...

PT-2026-95227

Name of the Vulnerable Software and Affected Versions OAKlouds affected versions not specified Description An Arbitrary File Read issue exists in OAKlouds developed by HGiga. Unauthenticated remote attackers can use Relative Path Traversal—a technique used to access files and directories stored...

PT-2026-95688

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A remote authenticated attacker can execute arbitrary code because the software does not properly limit pathnames to a restricted directory. Recommendations At the moment, there is no...

PT-2026-95317

Name of the Vulnerable Software and Affected Versions HCLSoftware AppScan 360° affected versions not specified Description A Path Traversal issue exists in the ASReportService component. This occurs due to improper handling of file paths, which allows an authenticated attacker to read or write...

PT-2026-95323

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A path traversal issue exists in the Desktop AP...

PT-2026-95324

Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A path traversal issue exists in the Audio API,...

PT-2026-95364

Name of the Vulnerable Software and Affected Versions SveltyCMS version 0.0.6 Description Improper access controls exist within the User Attribute Update Endpoint, specifically affecting the file src/routes/api/...path/+server.ts. This flaw allows a remote attacker to manipulate the system due to...

PT-2026-95236

Name of the Vulnerable Software and Affected Versions King Addons for Elementor versions prior to 51.1.81 Description The plugin fails to perform per-object authorization checks for image-optimization actions. It relies on a coarse capability shared by lower-privileged users and does not verify...

PT-2026-95669

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A path traversal issue allows a remote authenticated attacker to access and traverse directories on the system. Path traversal is a flaw that allows an attacker to use special characters to...

CVE-2026-79954: Missing Authentication for Critical Function

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand TC receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, but it does not verify that the selected SA is authorized for the...

EulerOS Virtualization 2.11.1 : rsync (EulerOS-SA-2026-3470)

According to the versions of the rsync packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link...

CVE-2026-21822: Improper Limitation of a Pathname to a Restricted Directory

HCLSoftware AppScan 360° was affected by a Path Traversal vulnerability in the ASReportService component. Improper handling of file paths allows an authenticated attacker to read or write files outside the intended directory, potentially enabling file system structure inspection or unauthorized...

PT-2026-95342

Name of the Vulnerable Software and Affected Versions Quarkus affected versions not specified Description An issue exists in Quarkus HTTP security where a discrepancy in path normalization between the security matcher and HTTP request dispatchers can be exploited. An unauthenticated attacker can...

EulerOS Virtualization 2.12.1 : sssd (EulerOS-SA-2026-3621)

According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in sssd. When authenticating with a YubiKey, the SSSD PAM responder can crash due to a use-after-free vulnerability,...

EulerOS Virtualization 2.12.0 : perl-Archive-Tar (EulerOS-SA-2026-3658)

According to the versions of the perl-Archive-Tar package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction...