AlmaLinux 9.2 [TuxCare] Security Update: freeradius / freeradius-devel / freeradius-doc / freeradius-krb5 / etc (ALMALINUX9.2:CLSA-2025:1743103421)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1743103421 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept,...

AlmaLinux 9.2 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc (ALMALINUX9.2:CLSA-2025:1739962899)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1739962899 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept,...

CentOS Linux 7 [TuxCare] Security Update: krb5-devel / krb5-libs / krb5-pkinit / krb5-server / etc (CENTOS7:CLSA-2025:1739387995)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2025:1739387995 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept,...

CVE-2026-81028

ZLMediaKit 's downloadFile API in server/WebApi.cpp suffers a root-directory confinement bypass caused by a string prefix comparison that does not enforce directory boundaries. The loader builds each configured root via File::absolutePath("", item, true), which omits the trailing separator; the h...

CVE-2026-81028 ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuration loader in server/WebApi.cpp builds each root with File::absolutePath"", item, true; because the relative-path argument is emp...

CVE-2026-81028 ZLMediaKit downloadFile Root-Directory Confinement Bypass via Prefix Collision

ZLMediaKit confines the downloadFile API to a configured set of root directories with a prefix comparison that does not account for directory boundaries. The configuration loader in server/WebApi.cpp builds each root with File::absolutePath"", item, true; because the relative-path argument is emp...

GHSA-FFGH-3JRF-8WVH Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

Impact Weblate repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed when the external path shares the same string prefix as t...

CVE-2026-40256 Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed whe...

CVE-2026-40256 Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed whe...

CVE-2026-40256 Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision

Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation relies on string prefix checks on resolved absolute paths. In multiple code paths, the check uses startswith against the repository root path. This is not path-segment aware and can be bypassed whe...

CVE-2026-40256

Weblate (localization tool) contains a defect in repository-boundary validation prior to version 5.17 where absolute path checks use a simple startswith against the repository root, not path-segment aware. This can be bypassed when an external path shares the same string prefix as the repository ...

GHSA-5Q48-Q4FM-G3M6 File Browser has an access rule bypass via HasPrefix without trailing separator in path matching

Hi, The Matches function in rules/rules.go uses strings.HasPrefix without a trailing directory separator when matching paths against access rules. A rule for /uploads also matches /uploadsbackup/, granting or denying access to unintended directories. Verified against v2.62.2 commit 860c19d. Detai...

Juniper Junos OS Vulnerability (JSA100056)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA100056 advisory. - RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge t...

CVE-2026-35030

LiteLLM is a proxy server AI Gateway to call LLM APIs in OpenAI or native format. Prior to 1.83.0, when JWT authentication is enabled enablejwtauth: true, the OIDC userinfo cache uses token:20 as the cache key. JWT headers produced by the same signing algorithm generate identical first 20...

GHSA-F7CQ-GVH6-QR25 Monitoring is vulnerable to Archive Slip due to missing checks in sanitization

The sanitizeArchivePath function in pkg/extract/extract.go lines 248–254 is vulnerable to a path traversal bypass due to a missing trailing path separator in the strings.HasPrefix check. A crafted tar archive can write files outside the intended destination directory when using the extractor CLI...

PT-2026-25863

Name of the Vulnerable Software and Affected Versions Romeo versions prior to 0.2.2 Description Romeo, a Go code coverage tool, contains a path traversal flaw in the sanitizeArchivePath function located in webserver/api/v1/decoder.go lines 80-88. This is due to a missing trailing path separator i...

Astra Linux – Vulnerability in krb5

The RADIUS protocol, as described in RFC 2865, is vulnerable to forgery attacks by local attackers who can modify any valid response—whether an Access-Accept, Access-Reject, or Access-Challenge response—into any other response, using a chosen-prefix collision attack against the MD5 Response...

CLSA-2025-1743103421 freeradius: Fix of CVE-2024-3596

CVE-2024-3596: fix chosen-prefix collision attack against MD5 Response Authenticator signature that allowed malicious modification of valid RADIUS responses...

Mageia: Security Advisory (MGASA-2024-0385)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

K000141008: RADIUS authentication vulnerability CVE-2024-3596

Security Advisory Description RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other response using a chosen-prefix collision attack against MD5 Response Authenticator...