Security Bulletin: IBM Event Endpoint Management is affected by a vulnerability in the uuid package

Summary IBM Event Endpoint Management is affected by a vulnerability in the uuid package that may allow out-of-range writes to caller-provided buffers when generating certain UUID versions. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of RFC9562 formerly RFC412...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerabilities have been resolved: x86/kvm: The teardown of PV features also occurs during boot-up. Various PV features Async PF, PV EOI, steal time work through memory shared with the hypervisor. When we resume from hibernation, we must properly teardown all...

Astra Linux – Vulnerability in Tomcat9

Path Equivalence: The use of ‘file.Name’ an internal dot notation can lead to Remote Code Execution, information disclosure, or the addition of malicious content to uploaded files via the write-enabled Default Servlet in Apache Tomcat. This issue affects Apache Tomcat versions as follows: 11.0.0-...

Astra Linux – Vulnerability in squashfs-tools

In Squashfs-Tools 4.5, the squashfsopendir variable in unsquash-1.c stores the filename within the directory entry. This filename is then used by unsquashfs to create the new file during the unsquash process. The filename is not validated for traversal outside of the destination directory, allowi...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftsetpipapo: Do not allow the “bad clone” to leak into subsequent transactions. When memory allocation fails, the cloned nftpipapomatch structure may enter a corrupted state: - Some fields’ lookup tables may be...

Astra Linux – Vulnerability in Xen

A issue was discovered in Xen versions 4.9 through 4.14.x. On the ARM architecture, a guest can control whether memory accesses bypass the cache. This means that Xen needs to ensure that all writes such as those during scrubbing have reached the memory before handing over the page to the guest...

Astra Linux – Vulnerability in python-setuptools

Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability exists in Setuptools prior to version 78.1.1. An attacker could be allowed to write files to arbitrary locations on the file system with the permissions of...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net: skbuff: The SKBFLSHAREDFRAG bit was not properly propagated through the frag-transfer helpers. Two frag-transfer helpers pskbcopyfclone and skbshift fail to propagate the SKBFLSHAREDFRAG bit in skbshinfo-flags when moving...

Astra Linux – Vulnerability in Git

Git is a distributed revision control system. git log can display commits in an arbitrary format using its --format specifiers. This functionality is also exposed to git archive via the export-subst gitattribute. When processing the padding operators, there is an integer overflow in...

[SECURITY] [DLA 4815-1] freecad security update

Debian LTS Advisory DLA-4815-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost October 03, 2026 https://wiki.debian.org/LTS Package : freecad Version : 0.20.2+dfsg1-4+deb12u1 CVE ID : CVE-2026-34789 CVE-2026-73234 CVE-2026-73235 Debian Bug : 1144349 Three...

Security Bulletin: Due to the use of HTTP/2 requests to a Jetty server, IBM Sterling Control Center is vulnerable to Uncontrolled Resource Consumption (CVE-2026-12611)

Summary HTTP/2 requests with Jetty server is used by IBM Sterling Control Center as part of dependency in jetty-http2-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-12611 DESCRIPTION: A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never...

CVE-2020-1048

CVE-2020-1048 Windows Print Spooler 서비스가 파일 시스템에 임의로 쓰기를 허용하는 부적절한 방식으로 인해 권한 상승 취약점이 존재합니다. 이 취약점을 성공적으로 악용한 공격자는 상승된 시스템 권한으로 임의 코드를 실행할 수 있습니다. 공격자는 이후 프로그램을 설치하거나 데이터를 보기, 변경, 삭제하거나 전체 사용자 권한으로 새 계정을 만들 수 있습니다. 이 취약점을 악용하려면 공격자는 영향을 받는 시스템에 로그온한 후 특수 제작된 스크립트나 애플리케이션을 실행해야 합니다. Microsoft...

Debian dla-4815 : freecad - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4815 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4815-1 [email protected]...

Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections

Summary Dulwich's porcelain.checkoutpaths=... code path writes files using raw os.openfilepath, OWRONLY|OCREAT|OTRUNC, mode followed by f.writeobj.data. This code path does NOT call buildfilefromblob at all, completely bypassing any symlink protections including the unreleased d09f8af fix. os.ope...

GHSA-5FQC-MRG8-W798 Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence

Summary Dulwich's filterbranch.py CommitFilter.applyindexfilter is vulnerable to symlink directory traversal. When processing commit history, materialized tree entries including symlinks persist in the working directory between commits, allowing a symlink from an ancestor commit to redirect file...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via verifyleadingdirs absent in affected versions in dulwich/stash.py during stash.pop. The old path-existence check used os.path.exists, which follows symlinks, so a stash entry whose parent path component is a symlink...

EUVD-2026-91122

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...

PT-2026-104366

Name of the Vulnerable Software and Affected Versions TaskingAI version 0.3.0 Description In the DALL-E 3 image generation tool, the save url image function contains a path traversal flaw. This allows attackers to write downloaded images to arbitrary locations on the server filesystem by...

Fedora 44 : sos (2026-594e78463a)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-594e78463a advisory. Security fix for CVE-2026-79655 Fixes a path traversal vulnerability in sos clean tar extraction where unvalidated symlink and hardlink targets could lead to...

CVE-2026-51906

In TaskingAI v0.3.0 in the DALL-E 3 image generation tool saveurlimage function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the projectid parameter...