Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Cloud Pak for Applications, is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM Enterprise Application Runtimes, is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in t...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a remote code execution and path-segment injection vulnerability (CVE-2026-14976, CVE-2026-15280)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by a remote code execution and path-segment injection vulnerability with the collectiveController-1.0 enabled. Vulnerability Details Refer to the security bulletins listed in the...

sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass

A path traversal flaw was found in SSSD's AD GPO provider. The adgpoextractsmbcomponents function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL...

EUVD-2026-52765

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...

CVE-2026-69259

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...

CVE-2026-69259 Flowise RCE via SQLite Record Manager Node

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...

GHSA-X3HF-7CJ6-3R4M Flowise RCE via SQLite Record Manager Node

============================================================================= Security Advisory elttam Topic: Flowise RCE via SQLite Record Manager Node Module: FlowiseAI/Flowise Disclosed: 24-Apr-2026 Credits: Alex Brown Affects: FlowiseAI/Flowise 3.1.2 I. Background Flowise AI is an open-source...

CVE-2026-67200

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...

ROOT-APP-NPM-CVE-2024-45296 CVE-2024-45296 in path-to-regexp - Patched by Root

Root has patched CVE-2024-45296 in the path-to-regexp package for Root:npm. Multiple fixed versions available...

ColdFusion - Path Traversal

ColdFusion versions 2025.9, 2023.20 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read and limited write access. An attacker could exploit this vulnerability to access sensitive...

CLSA-2026-1783731816 TuxCare security update for path-to-regexp (8 CVEs)

TuxCare rebuilt path-to-regexp to address 8 CVEs. Fixed in 6.2.1-tuxcare.1...

GHSA-2364-JH4Q-M9VM Flowise: IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint

Summary An Insecure Direct Object Reference IDOR vulnerability exists at the GET /api/v1/organization/customer-default-source endpoint. This flaw allows an authenticated attacker to bypass authorization checks and retrieve sensitive payment and profile information of other customers by manipulati...

CVE-2026-67200 Perspective 5.0.0 Path Traversal via cwd_static_file_handler

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...

CVE-2026-67200 Perspective 5.0.0 Path Traversal via cwd_static_file_handler

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...

EUVD-2026-52696

Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths. Attackers can bypass the insufficient query-string-stripping sanitization to...

CVE-2026-67200

CVE-2026-67200 refers to a path traversal in Perspective 5.0.0, exploitable by unauthenticated remote attackers who include literal ../ in HTTP request paths to read arbitrary server files via the cwd_static_file_handler. The vulnerability bypasses insufficient query-string-stripping sanitization...

CVE-2026-18806

The CVE-2026-18806 entry concerns pardus-image-writer (before 1.0.4) with an external control of the file name or path vulnerability. The issue is described across CVE/NVD/CVELIST as affecting pardus-image-writer and enabling potential unauthorized modification of file targets, with CVSS 3.1 vect...

CVE-2026-18806

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 1.0.4...

EUVD-2026-52668

External control of file name or path vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-image-writer allows Removing Important Client Functionality. This issue affects pardus-image-writer: before 1.0.4...