134230 matches found
NPM: CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
NPM: CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes vulnerability discovered by ? in WordPress Npm deepseek-tui versions = 0.8.32, 0.8.41...
EUVD-2026-60972
CodeWhale: imageanalyze follows workspace symlinks, leaking external file bytes...
CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
GHSA-W7WX-5Q49-R59W CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes
Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is...
CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...
CVE-2026-50553
Note Mark (open-source Go note-taking app, module github.com/enchant97/note-mark/backend) is vulnerable to a path traversal in its data-export CLI commands (migrate export and migrate export-v1) prior to version 0.19.5 . The root cause is an unanchored regex ([a-z0-9-]+) used to validate book and...
EUVD-2026-71618
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...
CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...
CVE-2026-50553 Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)
Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"a-z0-9-+". huma compiles this with regexp.MustCompiles.Pattern and tests it with patternRe.MatchStringstr, an UNANCHORED match. Because th...
CVE-2026-17622
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...
CVE-2026-17621
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...
CVE-2026-14470
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
Exploit for CVE-2026-11613
CVE-2026-11613 — Divi Ajax Filter RCE | | | |---|---| | Plug...
CVE-2026-14470 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
CVE-2026-14470
IBM Langflow OSS versions 1.0.0 through 1.10.2 is vulnerable to a path traversal flaw (CWE-22) in its file and knowledge base components. An authenticated attacker can send a crafted URL request containing ../ sequences to read arbitrary files on the system. Per the IBM security bulletin, in the ...
EUVD-2026-71491
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
CVE-2026-14470 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...
CVE-2026-17621 Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base components
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...
CVE-2026-17621
IBM Langflow OSS versions 1.0.0 through 1.10.2 are affected by a path traversal vulnerability (CWE-22) in its file and knowledge base components. The root cause involves user-supplied path values not being validated against /../ sequences in the Directory component, the Knowledge Base connector i...
EUVD-2026-71464
IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...