CVE-2021-38163

CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization Vulnerability Description CVE-2021-38163 is a security vulnerability in SAP NetWeaver Application Server AS Java that allows an authenticated attacker to upload arbitrary files to the server, potentially leading to remote code execution RCE...

CVE-2026-112390

A flaw was found in Pillow. This vulnerability allows a remote attacker to cause a Denial of Service DoS by supplying a specially crafted Microsoft Image Composer MIC file. When an application attempts to count or extract frames from the malicious image, an improper state reset triggers an infini...

ROOT-APP-COMPOSER-AIKIDO-2026-123768 AIKIDO-2026-123768 in magento/product-enterprise-edition - Patched by Root

Root has patched AIKIDO-2026-123768 in the magento/product-enterprise-edition package for Root:Composer. Multiple fixed versions available...

ROOT-APP-COMPOSER-AIKIDO-2026-248927 AIKIDO-2026-248927 in magento/product-community-edition - Patched by Root

Root has patched AIKIDO-2026-248927 in the magento/product-community-edition package for Root:Composer. Multiple fixed versions available...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, before versions 2.2.24 and 2.7.7, the composer install command executed within a Git/HG repository with specially crafted branch names could lead to command injection. This required cloning untrusted repositories. Patches are available ...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. The URLs for Mercurial repositories in the composer.json file at the root level, as well as the source download URLs, are not sanified correctly. Specifically crafted URL values allow code to be executed via the HgDriver if hg/Mercurial is installed on th...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. Users who publish a composer.phar file to a publicly accessible web server where the file can be executed as a PHP file may be subject to a remote code execution vulnerability if PHP also has registerargcargv enabled in php.ini. Versions 2.6.4, 2.2.22, an...

CVE-2026-109153

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted...

CVE-2026-109153 MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted...

CVE-2026-109153

A path traversal vulnerability exists in MosaicML Composer up to version 0.32.1 . The flaw is located in the Checkpoint Extraction component, specifically within the tarball.extractall function of the composer/utils/checkpoint.py file. This vulnerability allows for remote execution of an attack. ...

CVE-2026-109153 MosaicML Composer Checkpoint Extraction checkpoint.py tarball.extractall path traversal

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted...

CVE-2026-109153

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted...

CVE-2026-89110

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

CVE-2026-89110

The SAP NetWeaver Visual Composer software is vulnerable to broken access control due to insufficient authorization checks within certain portal functionalities. An attacker with low privileges can exploit this flaw to invoke internal operations on a preconfigured remote system. Depending on the ...

EUVD-2026-98192

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

CVE-2026-89110 Broken Access Control in SAP NetWeaver Visual Composer

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...

PT-2026-111405

Name of the Vulnerable Software and Affected Versions MosaicML Composer versions prior to 0.32.2 Description A path traversal issue exists in the Checkpoint Extraction component within the tarball.extractall function of the composer/utils/checkpoint.py file. This flaw allows a remote attacker to...

CVE-2026-109153: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted...

PT-2026-111137

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Visual Composer affected versions not specified Description Insufficient authorization checks in certain portal functionality allow an attacker with low privileges to invoke internal operations on a preconfigured remote system...

CVE-2026-89110: Exposed Dangerous Method or Function

SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise...