3340 matches found
Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate with watsonx Assistant Cartridge version 5.3.2 Vulnerability Details CVEID:CVE-2025-55132 DESCRIPTION: A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via futimes even...
Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate with watsonx Assistant Cartridge
Summary Multiple vulnerabilities were addressed in IBM watsonx Orchestrate with watsonx Assistant Cartridge version 5.3.2 Vulnerability Details CVEID:CVE-2026-24398 DESCRIPTION: Hono is a Web application framework that provides support for any JavaScript runtime. Prior to version 4.11.7, IP...
CVE-2021-47942
Home Assistant Community Store HACS prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh...
CVE-2021-47942
Home Assistant Community Store HACS prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh...
CVE-2021-47942
CVE-2021-47942 concerns Home Assistant Community Store (HACS) 1.10.0. The vulnerability is a path traversal flaw exposed via the /hacsfiles/ endpoint, allowing unauthenticated attackers to read sensitive files (notably .storage/auth) and retrieve credentials/refresh tokens. With this access, an a...
CVE-2021-47942 Home Assistant Community Store 1.10.0 Path Traversal Account Takeover
Home Assistant Community Store HACS prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh...
CVE-2021-47942
Home Assistant Community Store HACS prior to 1.10.0 contains a path traversal vulnerability that allows unauthenticated attackers to read sensitive files by traversing directories via the /hacsfiles/ endpoint. Attackers can retrieve the .storage/auth file containing user credentials and refresh...
Mass Assignment
Flowise is vulnerable to Mass Assignment. The vulnerability is due to missing server-side validation and authorization checks in the assistant update endpoint, which allows an authenticated attacker to manipulate server-controlled properties such as workspaceId and reassign assistants to arbitrar...
Home Assistant 路径遍历漏洞
Home Assistant is an open-source family automation management system developed by Home Assistant. This system is primarily used to control household automation devices. Version 1.10.0 of Home Assistant contains a path traversal vulnerability. This vulnerability stems from path traversal issues,...
PT-2026-41449
Name of the Vulnerable Software and Affected Versions Home Assistant Community Store HACS version 1.10.0 Description A path traversal issue allows unauthenticated attackers to read sensitive files by traversing directories via the '/hacsfiles/' endpoint. This can be used to retrieve the...
calibrate-agent (>=0.0.1 <=0.0.43), nvidia-pipecat (=0.4.0) +2 more potentially affected by CVE-2026-44716 via pipecat-ai (>=0.0.90 <=0.0.98)
pipecat-ai PYPI version =0.0.90, =0.0.1, =1.6.1.dev8325111910350515310, =1.7.1.dev260424103102100484 Source cves: CVE-2026-44716 Source advisory: SNYK:PYTHON-PIPECATAI-16700145...
FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
Summary Type: Mass assignment via Object.assignentity, body - client-controlled workspaceId and on create, id overwritten on the Assistant entity - cross-workspace data takeover and IDOR. File: packages/server/src/services/assistants/index.ts Root cause: The Assistant controller/service construct...
GHSA-78PR-C5X5-JGGC FlowiseAI: Assistant create+update mass-assignment allows cross-workspace assistant takeover
Summary Type: Mass assignment via Object.assignentity, body - client-controlled workspaceId and on create, id overwritten on the Assistant entity - cross-workspace data takeover and IDOR. File: packages/server/src/services/assistants/index.ts Root cause: The Assistant controller/service construct...
NPM: FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment
NPM: FlowiseAI has Mass Assignment in Assistant Update Endpoint that Allows Cross-Workspace Resource Reassignment vulnerability discovered by ? in WordPress Npm flowise versions = 3.1.1...
CVE-2025-35990
CVE-2025-35990 affects Intel Endpoint Management Assistant (EMA) software prior to version 1.14.5. The vulnerability arises from improper input validation in Ring 3 user-space components, enabling an unauthenticated, low-complexity attacker with adjacent access to cause an escalation of privilege...
Intel Endpoint Management Assistant 输入验证错误漏洞
Intel Endpoint Management Assistant is a management software developed by Intel Corporation in the United States. This software provides security and convenience for remote work. Versions of Intel Endpoint Management Assistant prior to 1.14.5 contained a vulnerability related to input validation...
HashiCorp Tooling 后置链接漏洞
HashiCorp Tooling is a series of software tools developed by HashiCorp Inc., aimed at infrastructure automation, cloud resource management, and security operations. Versions of HashiCorp Tooling prior to 0.42.0 contained a postback link vulnerability. This vulnerability stemmed from a sandbox pat...
PT-2026-40078
Improper input validation for some Intel Endpoint Management Assistant EMA software before version 1.14.5 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable escalation...
Intel® EMA Software Advisory
Summary: A potential security vulnerability in the Intel® Endpoint Management Assistant EMA software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2025-35990 Description: Improper input validation...
