29902 matches found
Security Bulletin: Vulnerability in undici affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in undici has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabilit...
Security Bulletin: Vulnerability in keras-team/keras affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in keras-team/keras has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information...
Security Bulletin: Vulnerability in undici affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in undici has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerabilit...
Security Bulletin: Vulnerability in Axios affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.
Summary Potential vulnerability in Axios has been identified that affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge - Assistant Builder Component. . The vulnerability have been addressed. Refer to details for additional information. Vulnerability...
Directory Traversal
Overview Affected versions of this package are vulnerable to Directory Traversal via the JavascriptImporter process. An attacker can access sensitive files by placing =include or =require directives in theme JavaScript assets, which allows referencing files outside the intended directory. The...
Directory Traversal
Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to Directory Traversal through IPIPANCorpusReader, CrubadanCorpusReader, and LinThesaurusCorpusReader in nltk/corpus/reader/ipipan.py,...
GHSA-8QX3-8GM5-9CJ2 pickem vulnerable to terminal escape-sequence injection via unsanitized item text
Impact pickem rendered item text label, description, group, meta, name to the terminal with no control-character sanitization. chrome.row only stripped ANSI from the active row; inactive rows, the public createFormatter, and selection-summary lines printed labels raw, and the ANSI strip missed ba...
pickem vulnerable to terminal escape-sequence injection via unsanitized item text
Impact pickem rendered item text label, description, group, meta, name to the terminal with no control-character sanitization. chrome.row only stripped ANSI from the active row; inactive rows, the public createFormatter, and selection-summary lines printed labels raw, and the ANSI strip missed ba...
GHSA-GXMW-5F7X-6G22 praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
Summary praisonaiagents/memory/filememory.py::FileMemory.init constructs all memory file paths by directly joining the userid parameter to a base path: python self.userpath = self.basepath / userid LINE 145 — no sanitization No validation or normalization is applied to userid before the path join...
praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
Summary praisonaiagents/memory/filememory.py::FileMemory.init constructs all memory file paths by directly joining the userid parameter to a base path: python self.userpath = self.basepath / userid LINE 145 — no sanitization No validation or normalization is applied to userid before the path join...
External Control of File Name or Path
Overview praisonaiagents is a Praison AI agents for completing complex tasks with Self Reflection Agents Affected versions of this package are vulnerable to External Control of File Name or Path via the FileMemory.init process when the userid parameter is not properly sanitized before being used ...
Directory Traversal
Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...
CVE-2026-57863
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863
Crater Invoice (through 6.0.6 ) contains a path traversal vulnerability in its self-update API. The root cause is unsanitized ZIP entry names containing ../ sequences passed to PHP's ZipArchive::extractTo(), allowing authenticated company owners to write arbitrary files outside the intended extra...
CVE-2026-57863 Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpoint
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
EUVD-2026-65478
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
CVE-2026-57863
Crater Invoice through 6.0.6 contains a path traversal vulnerability in the self-update API that allows authenticated company owners to write arbitrary files outside the intended extraction directory by supplying crafted ZIP archives with ../ sequences to the unzip endpoint. Attackers can exploit...
