CVE-2026-107716

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory,...

CVE-2026-105275

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files...

GHSA-556J-VV39-8RQV Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

Summary In banks.registries.DirectoryPromptRegistry, prompt file paths and the index file index.json do not refuse symbolic links. When a prompt directory contains or accepts untrusted files e.g. unpacked archives, shared repositories, or multi-tenant folders, symbolic links pointing outside the...

PraisonAI: SecurityPolicy command/path/import restrictions are completely unenforced by the default SubprocessSandbox backend

Summary SecurityPolicy in praisonaiagents/sandbox/config.py is a documented configuration data class with fields for allowsubprocess, allowedpaths, blockedpaths, allowedcommands, blockedcommands, allowedimports, and blockedimports. Its strict classmethod is explicitly described as creating "a...

CVE-2026-89091

A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...

CVE-2026-107716 Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory,...

CVE-2026-107716 Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry

Banks generates meaningful LLM prompts using a simple template language. Prior to 2.5.1, Banks DirectoryPromptRegistry does not reject symbolic links for index.json or discovered and existing .jinja prompt files. In an application where untrusted users can influence a prompt directory,...

CVE-2026-107716

The Banks library, used for generating LLM prompts, contains a symlink traversal vulnerability in the DirectoryPromptRegistry component prior to version 2.5.1 . The root cause is that the registry fails to reject symbolic links for index.json or .jinja prompt files. If an attacker can influence t...

CVE-2026-75875

IBM Guardium Data Protection versions 12.0, 12.1, and 12.2 are vulnerable to a path traversal vulnerability (CWE-22) within the Sniffer component . This flaw could allow a remote attacker to execute arbitrary code . To remediate this, IBM strongly recommends applying the latest Sniffer patch (fix...

CVE-2026-75875 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal...

CVE-2026-75875 Multiple vulnerabilities affect the Sniffer component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to path traversal...

CVE-2026-84247 IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...

CVE-2026-84247

IBM Guardium Data Protection version 12.2 is vulnerable to a path traversal vulnerability (CWE-22), which could allow a remote authenticated attacker to cause a denial of service . IBM has addressed this vulnerability in a system update. To remediate, customers are encouraged to update their syst...

Exploit for Path Traversal in Apache Http_Server

Apache HTTP Server 2.4.50 Path Traversal and RCE CVE-2021-420...

CVE-2026-21857

CVE-2026-21857: Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Overview Field| Details ---|--- CVE ID| CVE-2026-21857 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products redaxo/source versions: = 5.20.1 CWE Classification CWE-22: Improper...

CVE-2026-105275

Satel Netco Design versions prior to v2.1.7 are vulnerable to a relative path traversal vulnerability within the data import functionality . An authenticated user with Viewer privileges can exploit this flaw to access file paths outside the intended directory and use observable application respon...

CVE-2026-105275 Satel Netco Design Relative Path Traversal

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files...

CVE-2026-19493

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 could allow a remote attacker to perform an arbitrary file write due to path traversal...

CVE-2026-101024

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful exploitati...

CVE-2026-101024 Satel Netco Design Relative path traversal

Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data export functionality. An authenticated user with Viewer privileges could write attacker influenced content to file system locations accessible to the application service. Successful exploitati...