CVE-2026-92080

MediumCVSS 4.3/10Last modified Nov 6, 2026

Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal.

This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
TÜBİTAK BİLGEM Software Technologies Research Institute	pardus-boot-repair	>= 1.0.8, < 1.1.0

References

https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1477

Timeline

Published: Nov 6, 2026
Last modified: Nov 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-920815.9fastify is a fast and low-overhead web framework for Node.js. In versions before 5.12.5, when a route registers a response trailer via reply CVE-2026-920826.3By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To CVE-2026-920837.8Missing Authorization vulnerability in TÜBİTAK BİLGEM Yazılım Teknolojileri Araştırma Enstitüsü pardus-image-writer allows Privilege Escalat CVE-2026-920849.1The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in a CVE-2026-920855.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. L CVE-2026-920865.3The MW WP Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.1.7 via the 'pos CVE-2026-920878.1@fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions CVE-2026-920888.6Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. Th CVE-2026-92099.8mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the r CVE-2026-920915.9A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(CVE-2026-920927.4A flaw was found in openshift-ansible. The installer container's `run` script downloads and executes remote inventory and dynamic scripts wi CVE-2026-920979.1The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 Th