24778 matches found
NPM: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
NPM: Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory vulnerability discovered by ? in WordPress Npm network-ai versions = 5.12.1...
Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Summary AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandboxevil/secret.txt. An agent/user that can call...
GHSA-JVCM-F35G-W78P Network-AI: AgentRuntime sandbox path-prefix checks allow file access outside the configured base directory
Summary AgentRuntime promises scoped file access under a configured sandbox basePath, but its path containment checks use raw string prefix tests. A sandbox base such as /tmp/network-ai-sandbox also matches a sibling path such as /tmp/network-ai-sandboxevil/secret.txt. An agent/user that can call...
GHSA-P9XJ-FPR2-JF2Q symfony/ux-toolkit: Path Traversal Allows Arbitrary File Write and Read via Crafted Recipe Manifest
Description The ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map. The only guard against malicious paths was Path::isRelative, which returns true for paths like ../../../etc. Path::join then resolves the .. segments without complaint, so the...
GHSA-CCV6-R384-XP75 Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Summary All components based on BaseFileComponent are vulnerable to the following vulnerability: 1. Docling DoclingInlineComponent 2. Docling Serve DoclingRemoteComponent 3. Read File FileComponent 4. NVIDIA Retriever Extraction NvidiaIngestComponent 5. Video File VideoFileComponent 6. Unstructur...
dzbanek-langflow-base (>=0.6.0, <=0.6.1), langflow-base (>=0.7.0, <=0.8.4) +1 more potentially affected by CVE-2026-55447 via lfx (>=0.1.13, <=0.3.4)
lfx PYPI version =0.1.13, =0.6.0, =0.7.0, =0.8.4 - langflow-nightly 1.8.0.dev24 Source cves: CVE-2026-55447 Source advisory: SNYK:PYTHON-LFX-17400345...
Insufficient Session Expiration
Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the logout. An attacker can maintain unauthorized access to a user's session by exploiting improper clearing of authentication cookies and tokens after logout. This may allow continued access to...
dzbanek-langflow-base (>=0.6.0, <=0.6.1) potentially affected by CVE-2026-55423 via lfx (0.1.13)
lfx PYPI version 0.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on lfx and may be impacted: - dzbanek-langflow-base =0.6.0, =0.6.1 Source cves: CVE-2026-55423 Source advisory: SNYK:PYTHON-LFX-17400336...
Authorization Bypass Through User-Controlled Key
Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the getflowbyidorendpointname function. An attacker can access and execute flows belonging to other users, potentially exposing sensitive data and consuming resources, by specifying t...
homeassistant-stubs (2022.8.7), mqtt-hass-base (>=4.0.0, <=4.0.7) +1 more potentially affected by CVE-2026-54317 via homeassistant (2022.8.7)
homeassistant PYPI version 2022.8.7 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.8.7 - mqtt-hass-base =4.0.0, =4.0.7 - pytest-homeassistant-custom-component 0.11.12 Source cves:...
homeassistant-stubs (2023.12.3), hydroqc2mqtt (>=1.1.2, <=1.2.0) +2 more potentially affected by CVE-2026-54317 via homeassistant (2023.12.3)
homeassistant PYPI version 2023.12.3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.12.3 - hydroqc2mqtt =1.1.2, =4.2.4, =4.2.5 - pytest-homeassistant-custom-component 0.13.85 Source cves:...
homeassistant-stubs (2022.6.7), mqtt-hass-base (>=3.2.1, <=3.2.2) +1 more potentially affected by CVE-2026-54317 via homeassistant (2022.6.7)
homeassistant PYPI version 2022.6.7 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.6.7 - mqtt-hass-base =3.2.1, =3.2.2 - pytest-homeassistant-custom-component 0.9.17 Source cves:...
EUVD-2019-20196
Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to comeasyshop, task set to...
Malicious code in base_parts_ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07b0e2bcf47f6720470181fe18dda70621d52a4fb65fec395a87e14ec39c5219 When a user runs the package's jcc or jcx CLI, lib/aiutils.js polls https://jai.jaskle.cn/hm/hmpub/aicccfg for a newVer value and, if it differs from...
MAL-2026-6228 Malicious code in base_parts_ai (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 07b0e2bcf47f6720470181fe18dda70621d52a4fb65fec395a87e14ec39c5219 When a user runs the package's jcc or jcx CLI, lib/aiutils.js polls https://jai.jaskle.cn/hm/hmpub/aicccfg for a newVer value and, if it differs from...
RLSA-2026:26456 Important: 389-ds-base security, bug fix, and enhancement update
389 Directory Server is an LDAP version 3 LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and command-line utilities for server administration. Security Fixes: 389-ds-base: 389-ds-base: unbounded LDAP controls count in...
Oracle Enterprise Manager Cloud Control (June 2026 CSPU)
The 13.5 and 24.1 versions of Enterprise Manager Base Platform installed on the remote host are affected by multiple vulnerabilities as referenced in the June 2026 CSPU advisory. - Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager component: Target...
CVE-2026-12157: Improper Neutralization of Input During Web Page Generation
The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of the betterdocs/category-slate-layout Gutenberg block in versions up to, and including, 4.5.3. This is due to insufficient...
PT-2026-51123
Name of the Vulnerable Software and Affected Versions Symfony UX versions 2.32.0 through 2.36.0 Symfony UX versions 3.0.0 through 3.1.9 Description The ux:install console command installs files from a recipe kit by copying paths listed in a copy-files map. Due to improper validation in...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues
Summary IBM Watson Speech Services Cartridge is vulnerable to multiple Base OS issues. We have updated the base image used by our Speech Services and the following vulnerabilities have been addressed. Please read the details for remediation below. Vulnerability Details CVEID:CVE-2025-14087...