dbgate-serve (>=7.1.3-alpha.3, <=7.1.4), dbmodel (>=7.1.3-alpha.3, <=7.1.4) potentially affected by CVE-2026-34725 via dbgate-web (>=7.1.3-alpha.3, <=7.1.4-alpha.2)

dbgate-web NPM version =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.3-alpha.3, =7.1.4 Source cves: CVE-2026-34725 Source advisory: OSV:GHSA-35XM-QVJG-8M42...

GHSA-8GC5-J5RX-235R vulnerabilities

Vulnerabilities for packages: langfuse-fips, dbgate, prism, kubeflow-pipelines, saf, langfuse, tileserver-gl-fips, librechat, kibana, dbgate-fips, tileserver-gl, renovate, jitsucom-jitsu...

CVE-2026-33036 vulnerabilities

Vulnerabilities for packages: langfuse-fips, dbgate, prism, kubeflow-pipelines, saf, langfuse, tileserver-gl-fips, librechat, kibana, dbgate-fips, tileserver-gl, renovate, jitsucom-jitsu...

GHSA-M7JM-9GC2-MPF2 vulnerabilities

Vulnerabilities for packages: langfuse-fips, dbgate, prism, saf, tileserver-gl-fips, kibana, dbgate-fips, tileserver-gl, renovate, langfuse...

CVE-2026-25896 vulnerabilities

Vulnerabilities for packages: langfuse-fips, dbgate, prism, saf, tileserver-gl-fips, kibana, dbgate-fips, tileserver-gl, renovate, langfuse...

GHSA-37QJ-FRW5-HHJH vulnerabilities

Vulnerabilities for packages: langfuse-fips, opensearch-dashboards-fips, dbgate, prism, kubeflow-pipelines, saf, langfuse, tileserver-gl-fips, librechat, kibana, opensearch-dashboards, dbgate-fips, tileserver-gl, renovate, jitsucom-jitsu...

CVE-2026-25128 vulnerabilities

Vulnerabilities for packages: langfuse-fips, opensearch-dashboards-fips, dbgate, prism, kubeflow-pipelines, saf, langfuse, tileserver-gl-fips, librechat, kibana, opensearch-dashboards, dbgate-fips, tileserver-gl, renovate, jitsucom-jitsu...

EUVD-2025-22773

Malicious code in bioql PyPI...

EUVD-2025-22767

Malicious code in bioql PyPI...

CVE-2025-50184

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

CVE-2025-50185

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via insufficient validation of file paths and types in the reader function. An attacker can access arbitrary files on the...

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview dbgate-api is an Allows run DbGate data-manipulation scripts. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the file parameter in the /uploads/get endpoint. An attacker can access arbitrary files on the system by supplying a...

CVE-2025-50185

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

CVE-2025-50184

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...

CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

CVE-2025-50185 DbGate allows Unauthorized File Access via CSV Plugin

DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and types. A user with application-level access can retrieve data from arbitrary files on the system, regardless of their location or file...

CVE-2025-50185

CVE-2025-50185 (DbGate) affects DbGate ≤ 6.6.0. Affected component: the dbgate-plugin-csv reader function, which does not validate file paths/types before reading files. This enables unauthorized access to arbitrary system files (e.g., /etc/shadow) by a user with application-level access, via the...

CVE-2025-50184 DbGate allows for File Traversal via file parameter

DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter is not properly restricted to the intended uploads directory. As a result, the endpoint that lists files within the upload directory can be...