CVE-2026-63952

A flaw was found in the Linux kernel's memfd component. When the SEALEXEC flag is used to create a memory file descriptor, the SEALWRITE flag is implicitly applied to prevent writing to executable memory. However, this implicit write protection is applied after checks that should deny writable...

CVE-2026-15724

Progress ShareFile Storage Zones Controller (SZC) vulnerable to path traversal in versions prior to 5.12.5 and 6.0.2. An authenticated administrative user can read arbitrary files, write to arbitrary directories, or check file existence on the server filesystem. Affected component: SZC; root caus...

CVE-2026-28321

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations...

CVE-2026-47397

CVE-2026-47397 (PraisonAI) affects PraisonAI up to version 4.6.37, where hidden webpage metadata can cause agents to write attacker-controlled content to arbitrary file paths. The root cause is an overly permissive path check in code/tools/write_file.py where path validation is skipped when works...

CVE-2026-47397 PraisonAI has an Arbitrary File Write in Python API

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. writefile skips path validation when workspace=None always None in production. Version 4.6.40 fixes the issue...

CVE-2026-47397 PraisonAI has an Arbitrary File Write in Python API

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage causes PraisonAI agents to write attacker-controlled content to arbitrary paths. writefile skips path validation when workspace=None always None in production. Version 4.6.40 fixes the issue...

libaom: libaom: arbitrary address write via SVC layer context OOB and cyclic refresh map pointer hijack

An arbitrary address write vulnerability was found in libaom, the reference AV1 codec implementation. A missing bounds check in the SVC Scalable Video Coding layer ID control function allows an attacker to inject an arbitrary pointer into the cyclic refresh map field via crafted image pixel value...

CVE-2026-64825

CVE-2026-64825 : Home Assistant Core prior to 2026.6.0 contains a path traversal vulnerability reachable during initial onboarding via a crafted backup archive. By manipulating the name field inside the archive’s backup.json to supply an absolute path, the code path using pathlib.Path.truediv dis...

CVE-2026-64825 Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field...

CVE-2026-64824 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

EUVD-2026-46300

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...

EUVD-2026-46299

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations...

CVE-2026-28321

SolarWinds Serv-U is affected by a broken access control vulnerability (CVE-2026-28321) that could allow arbitrary file read and write, enabling privilege escalation and code execution as root. A domain administrator access is required, and impact is lower on Windows installations. The provided c...

CVE-2026-28321 SolarWinds Serv-U Broken Access Control Vulnerability

SolarWinds Serv-U is affected by a broken access control vulnerability that could allow arbitrary file read and write, which can then be used to escalate privileges and execute code as root. A domain administrator access is required, and the impact is lower in Windows installations...

EUVD-2026-46265

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...

CVE-2026-47121

Sparkle vulnerability CVE-2026-47121 (affecting macOS AutoUpdate) arises from a defense-in-depth gap in delta application. An archive item can create a symlink in the destination tree and a subsequent file write may traverse the symlink path, allowing writes outside the intended destination when ...

CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta

Sparkle is a software update framework for macOS. Prior to version 2.9.2, Autoupdate/SUBinaryDeltaApply.m enforces relativePath.pathComponents containsObject:@".." and rejects writes whose immediate parent directory IS itself a symbolic link, but does not detect symlinks deeper in the relative...

SUSE CVE-2026-53375

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: Prevent partial address patches In the case that only one of lo/hi is valid, the patching could result in a bad address written to in FW...

SUSE CVE-2026-63949

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length messagestore linedispdisplay unconditionally reads msgcount - 1 before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg-1:...

SUSE CVE-2026-63952

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...