IBM App Connect Enterprise 12.0.1.x < 12.0.12.30 / 13.0.1.x <= 13.0.8.2 Arbitrary File Write (7293001)

The version of IBM App Connect Enterprise installed on the remote host is 12.0.1.x prior to 12.0.12.30, or 13.0.1.x prior or equal to 13.0.8.2. It is, therefore, affected by an arbitrary file write vulnerability. IBM App Connect Enterprise could allow a local attacker to perform an arbitrary file...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: UDF: Fixed uninitialized array access for some pathnames For filenames that start with . and are between 2 and 5 characters long, the UDF charset conversion code would read uninitialized memory from the output buffer. The only...

Astra Linux – Vulnerability in pillow

In version 9.0.1, Pillow allows attackers to delete files because spaces in temporary pathnames are mishandled...

Astra Linux – vulnerability in ntfs-3g

In NTFS-3G versions prior to 2021.8.22, providing a specially crafted NTFS inode pathname in an NTFS image can lead to a heap buffer overflow, resulting in memory disclosure, denial of service, and even code execution...

CVE-2026-105840

The lrzsz utility, in versions before 0.13.0 , is vulnerable to a path traversal issue within the lrz receive utility's restricted mode. The root cause is located in src/lrz.c, where the checkpath() function fails to reject absolute pathnames unless the software is specifically built with --enabl...

Astra Linux – Vulnerability in unoconv

The unoconv package before version 0.9 mishandles untrusted pathnames, resulting in SSRF and local file inclusions...

CVE-2026-85439

MOOS-IvP through 24.8.1 contains a command injection vulnerability in alogsplit 's SplitHandler::handlePreCheckSplitDir() function, which fails to sanitize shell metacharacters in log file pathnames. An attacker can embed shell syntax in log file names or the --dir parameter to execute arbitrary ...

Pallets Werkzeug <0.15.5 - Local File Inclusion Detection

Pallets Werkzeug before 0.15.5 is susceptible to local file inclusion because SharedDataMiddleware mishandles drive names such as C: in Windows pathnames. !/usr/bin/env python3 -- coding: utf-8 -- """Pallets Werkzeug before 0.""" from kittysploit import from lib.protocols.http.httpclient import...

libzypp metadata processing Code Execution

The vulnerability of the file metadata processing mechanism in the repomd.xml repository file of the libzypp library is related to errors in the mechanism for handling relative pathnames to directories. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

Gogs Code Execution

The vulnerability of the internal/database/org.go function in the software for creating self-managed Git repositories called Gogs is related to errors in the mechanism for handling relative pathnames to directories. Exploiting this vulnerability could allow a malicious actor to execute arbitrary...

Microsoft Visual Studio Code Editor Path Traversal

The vulnerability of Microsoft Visual Studio Code’s editor is related to errors in the mechanism for handling relative pathnames to directories. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerabilities have been resolved: ntfs: -dcompare must not block. … So don’t use getname there. Switch it to kmallocPATHMAX, GFPNOWAIT. Yes, ntfsdhash can almost certainly handle smaller allocations, but let the ntfs team deal with that—keep the allocation siz...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-pillow (UTSA-2026-017340)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017340 advisory. Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. Tenable has extracted the preceding description block...

CLSA-2026-1777446568 bash: Fix of CVE-2019-9924

CVE-2019-9924: reject attempts to add pathnames containing slashes to the hash table in restricted shell...

bash: Fix of CVE-2019-9924

CVE-2019-9924: reject attempts to add pathnames containing slashes to the hash table in restricted shell...

JLSEC-2026-289

In Singular before 4.3.1, a predictable /tmp pathname is used e.g., by sdb.cc, which allows local users to gain the privileges of other users via a procedure in a file under /tmp. NOTE: this CVE Record is about sdb.cc and similar files in the Singular interface that have predictable /tmp pathname...

EUVD-2026-15886

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through 18.5...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-1582)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the...

EulerOS 2.0 SP11 : kernel (EulerOS-SA-2026-1610)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-005797)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005797 advisory. In the Linux kernel, the following vulnerability has been resolved: udf: Fix uninitialized array access for some pathnames For filenames that begin with . and are...