CVE-2026-110717 Janus WebRTC Server through 1.4.3 Path Traversal via Record&Play Filename

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110717

Janus WebRTC Server through 1.4.3 contains a path traversal vulnerability in the Record&Play plugin that allows unauthenticated attackers to write files outside recordingspath via the record request filename. Attackers can supply filenames with path separators to create or truncate files ending i...

CVE-2026-110657 Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or...

CVE-2026-110657 Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 Path Traversal via Variable Label

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or...

EUVD-2026-101130

Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or...

CVE-2026-110657

The Khronos NNEF-Tools packages, specifically nnef through version 1.0.10 and nnef-tools through version 1.0.11, are vulnerable to a path traversal vulnerability (CWE-22). This flaw allows an attacker to write files outside the intended model directory by providing a graph.nnef file containing cr...

EUVD-2026-101260

Report One MyReport Updater through 2.1.1 exposes an unauthenticated gRPC service on TCP port 9095 that allows remote attackers to redirect the SYSTEM updater by invoking the UpdateConfigReferent method. Attackers can point the updater to a malicious reference server serving modified module...

[SECURITY] [DSA 6559-1] buildstream security update

------------------------------------------------------------------------- Debian Security Advisory DSA-6559-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff October 14, 2026 https://www.debian.org/security/faq -...

Linux Distros Unpatched Vulnerability : CVE-2026-109956

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated...

CVE-2026-79715 IBM WebSphere Application Server Liberty Path Traversal

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory...

CVE-2026-110235 MP Manager through 1.1.0 Path Traversal via Archive Extraction sanitizeEntryName Bypass

MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting fil...

CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

UBUNTU-CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

CVE-2026-74043

Wazuh versions 4.1.1 before 4.14.8 are vulnerable to a path traversal vulnerability within the upload_list_file, upload_rule_file, and upload_decoder_file functions. This flaw allows malicious cluster workers who possess the cluster key to bypass REST controller validation by sending DistributedA...

CVE-2026-109956

NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by supplying unvalidated model paths. Attackers controlling the modelfilename or model argument can make the weka JVM write files via -d or probe files via -l...

CVE-2026-79715: Improper Limitation of a Pathname to a Restricted Directory

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An attacker could use a specially crafted application archive to write files outside the intended directory...

PT-2026-111570

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.1.1 through 4.14.7 Description A path traversal issue exists in the upload list file, upload rule file, and upload decoder file functions. Attackers possessing the cluster key can send DistributedAPI requests containing ../...

EUVD-2026-97873

Vercel deepsec from 0.1.0 before 1.1.17 contains a link following vulnerability in extractTarballLocally that allows sandboxed code to write files outside the sandbox by planting links in result tarballs. Attackers controlling sandbox code, such as a prompt-injected coding agent, can plant symbol...

CVE-2026-104102 copyparty FTP: upload outside defined volumes (limited path traversal)

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configur...

PT-2026-110871

Name of the Vulnerable Software and Affected Versions copyparty versions prior to 1.20.19 Description FTP upload path handling fails to confine destinations to configured volumes. When FTP or FTPS is enabled, a low-privileged authenticated user can use traversal paths during upload to create new...