CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...

CVE-2026-49453

Joplin (open-source note-taking app) contains a path traversal in its resource synchronization mechanism prior to versions 3.6.15 and 3.7.2 . The root cause is that synchronized resource metadata fields (id or file_extension) are stored unvalidated by BaseItem.unserialize(), then concatenated int...

CVE-2026-49453 Joplin: Path traversal in resource sync — silent arbitrary file write outside the resource directory

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or fileextension contains parent-directory or path-separator characters. BaseItem.unserialize stores the...

PT-2025-48834

Уязвимость программного средства управления проектами и задачами JetBrains YouTrack связана с ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти существующие ограничения безопасности...

Security update for the Linux Kernel

The SUSE Linux Enterprise 15 SP5 kernel was updated to receive various security bugfixes. The following security bugs were fixed: CVE-2022-49053: scsi: target: tcmu: Fix possible page UAF bsc1237918. CVE-2022-49465: blk-throttle: Set BIOTHROTTLED when bio has been throttled bsc1238919...