CVE-2026-108595: Incorrect Authorization

Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspaceonlywrites and readonly mode by supplying an unchecked workdir to agentspawn. Attackers can plant prompt-injected instructions in processed content so the agent spawns a worker...

K000163625: Arm CPU vulnerability CVE-2025-10263

Security Advisory Description Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C, Cortex-A710, Cortex-A78, A78AE & A78C, Cortex-A77, Cortex-A76 & A76A may allow writes to resources owned b...

CLEANSTART-2026-UC87477 If LimitXMLRequestBody is set to allow request bodies larger than 350MB (defaults to 1M) on 32 bit systems an integer overflow happens which later causes out of bounds writes

Security vulnerability affects the apache2 package. If LimitXMLRequestBody is set to allow request bodies larger than 350MB defaults to 1M on 32 bit systems an integer overflow happens which later causes out of bounds writes...

EUVD-2026-95327

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Improper Input Validation.

Summary uuid is used by IBM Fusion Data Foundation, which could cause Improper Input Validation. CVE-2026-41907. Vulnerability Details CVEID:CVE-2026-41907 DESCRIPTION: uuid is for the creation of RFC9562 formerly RFC4122 UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but d...

CVE-2026-84230

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map...

CVE-2026-84275

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector...

DEBIAN-CVE-2026-19585

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-19585 Go-getter vulnerable to a path traversal in S3/GCS directory download handling

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

EUVD-2026-95078

HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability CVE-2026-19585 is fixed in go-getter 1.8.10 and...

CVE-2026-85490

Brocade ASCG versions prior to 3.5.0 are vulnerable to an arbitrary file write via a path traversal flaw. The application fails to sanitize path traversal sequences within support bundle archives ingested from remote compromised endpoints before extraction. An unauthenticated remote attacker who ...

CVE-2026-5049

A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...

PT-2026-108182

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description An unauthenticated attacker can exploit a path traversal issue within the GIM file-upload functionality to write arbitrary files to the Collector. Path traversal is a technique that allows ...

CVE-2026-84230: Concurrent Execution using Shared Resource with Improper Synchronization

IBM Guardium Data Protection 12.2.2 could allow a remote attacker to cause a denial of service due to a race condition resulting from concurrent unsynchronized writes to a shared map...

EulerOS 2.0 SP15 : python-setuptools (EulerOS-SA-2026-4010)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal...

CVE-2026-41958

A flaw was found in VisiData. This path traversal vulnerability allows a remote attacker to perform arbitrary file writes on the host system. By convincing a user to process a specially crafted URL pointing to a malicious ZIP archive, an attacker can extract files outside the intended destination...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts

Gitea validated a push mirror's remote address against the migrations allow and block lists only when the mirror was created. Each synchronization passed the stored address directly to git push, so a name that later resolved to a blocked or internal address was still reached. A user with...

CVE-2026-89430

The Gitea platform is vulnerable to a Server-Side Request Forgery (SSRF) and forced write vulnerability due to insufficient validation of push mirror remote addresses. The system only validates these addresses against [migrations] allow and block lists during the initial mirror creation. Because ...