CVE-2026-49836

psd-tools (Python library for Adobe Photoshop PSD files) is vulnerable to arbitrary file write and arbitrary file read via unsanitized smart-object paths. In all releases through v1.17.0 , SmartObject.save() uses the embedded filename from the PSD verbatim—no basename, no .. filtering, no absolut...

CVE-2026-79725 Langflow is vulnerable to unauthorized file system access due to path traversal and missing storage path validation

IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to read arbitrary files due to improper access control...

CVE-2026-79725

IBM Langflow OSS versions 1.0.0 through 1.11.5 are affected by an improper access control flaw (CWE-284 ) that allows a remote authenticated attacker to read arbitrary files. The vulnerability is part of a broader set of storage-path issues: the flow execution runtime accepts attacker-controlled ...

CVE-2026-80424 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction...

CVE-2026-80424

IBM DataStage on Cloud Pak for Data version 5.4.0.0 is affected by a path traversal vulnerability (CWE-22) that occurs during archive extraction , allowing a remote authenticated attacker to create arbitrary files. The flaw is rated CVSS 9.1 (Critical) with a scope change, reflecting high integri...

CVE-2026-80424 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction...

CVE-2026-81210

IBM DataStage on Cloud Pak for Data 5.4.0.0 is vulnerable to an IDOR combined with path traversal issue. Three caller-supplied strings are concatenated into a String.format path on the shared /ds-storage RWX PVC and the resulting file is returned with no project ACL check. Although reads are cons...

CVE-2026-81210 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs...

CVE-2026-81210 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 concatenates three caller-supplied strings into a String.format path on the shared /ds-storage RWX PVC and returns the file with no project ACL — pure IDOR plus traversal. Read is constrained to files named job.log/error.log, but DataStage job logs...

CVE-2026-81540

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by a path traversal vulnerability that allows a remote authenticated attacker to overwrite ruleset files belonging to other tenants . The CVSS 3.1 score is 8.5 (HIGH) with a changed scope, reflecting the cross-tenant integrity impact and low...

CVE-2026-81540 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...

CVE-2026-81540 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...

CVE-2026-81551

IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal vulnerability (CWE-22) that allows a remote authenticated attacker to arbitrarily write to or delete files on shared storage . The CVSS 3.1 score is 8.8 (High) , reflecting network attack vector, low complexity, and high impact...

CVE-2026-81551 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability...

CVE-2026-81551 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnerability...

CVE-2026-81554 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-81554

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability (CWE-22). According to IBM's security bulletin, this CVE is part of a group of vulnerabilities introduced through open source pac...

CVE-2026-82092 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...

CVE-2026-82092

IBM DataStage on Cloud Pak for Data 5.4.0.0 is affected by an absolute-path traversal vulnerability that allows a remote, authenticated attacker to obtain sensitive information. The IBM-assigned CVSS 3.1 score is 8.8 (High) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting high imp...

CVE-2026-82092 DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability...