EUVD-2026-33926

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::readfromdisc are passed without validation to paths.buildpackagespackage, whi...

EEF-CVE-2026-43965 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion

Summary Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::read\from\disc are passed without validation to...

CVE-2026-43965

Gleam path traversal vulnerability CVE-2026-43965 allows arbitrary directory deletion via malicious build/packages/packages.toml content. During deps download, package keys read from build/packages/packages.toml are passed to path construction without validation, enabling absolute or relative tra...

CVE-2026-43965

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::readfromdisc are passed without validation to paths.buildpackagespackage, whi...

CVE-2026-43965 Path Traversal in build/packages/packages.toml Allows Arbitrary Directory Deletion

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from build/packages/packages.toml by LocalPackages::readfromdisc are passed without validation to paths.buildpackagespackage, whi...

a2 (>=0.1.0, <=0.3.17), abadpour (>=6.13.1, <=7.24.1) +972 more potentially affected by CVE-2026-3198 via mlflow (>=0.8.2, <=3.15.1)

mlflow PYPI version =0.8.2, =0.1.0, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.3.0, =0.0.5, =1.0.0, =0.1.0, =1.1.1 - ai-helpers-pytorch-utils 0.1.0a1 - aidevelopementtoolkit 0.2.0 and more Source cves: CVE-2026-3198 Source advisory: SNYK:PYTHON-MLFLOW-17231495...

arbor-ai (>=0.1.5, <=0.1.14), coreason-runtime (>=0.1.0, <=0.11.1) +13 more potentially affected by CVE-2026-10300 via sglang (>=0.1.26, <=0.5.17)

sglang PYPI version =0.1.26, =0.1.5, =0.1.0, =1.1.0rc1, =2.0.0b40, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1.post1, =0.1.1, =0.0.0, =0.8.0, =0.10.8 Source cves: CVE-2026-10300 Source advisory: SNYK:PYTHON-SGLANG-17739025...

Injection axios Dependency in Bamboo Data Center

This High severity Injection vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Injection vulnerability, with a CVSS Score of 7.4 and a CVSS Vector of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N allows an unauthenticated attack...

@a1st/aix (>=0.0.3, <=0.6.0), @a1st/aix-core (>=0.2.0, <=0.6.0) +99 more potentially affected by CVE-2026-47428 via vitest (>=4.0.17, <=4.1.5)

vitest NPM version =4.0.17, =0.0.3, =0.2.0, =0.0.21, =0.79.1, =2.1.0-alpha.278, =2.1.0-alpha.281 and more Source cves: CVE-2026-47428 Source advisory: SNYK:JS-VITEST-17120487...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +9 more potentially affected by CVE-2026-47428 via @vitest/browser (>=4.0.17, <=4.1.5)

@vitest/browser NPM version =4.0.17, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.17, =4.0.17, =4.0.17, =0.6.0-rc.1, =0.1.18, =0.2.2 Source cves: CVE-2026-47428 Source advisory: SNYK:JS-VITESTBROWSER-17120486...

@aamini/config (>=0.0.1, <=0.0.13), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +9 more potentially affected by CVE-2026-47428 via @vitest/browser (>=4.0.17, <=4.1.5)

@vitest/browser NPM version =4.0.17, =0.0.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.17, =4.0.17, =4.0.17, =0.6.0-rc.1, =0.1.18, =0.2.2 Source cves: CVE-2026-47428 Source advisory: OSV:GHSA-2H32-95RG-CPPP...

@astralis-os/vitest (2.4.1), @aws/nx-plugin (>=0.79.1, <=0.84.2) +75 more potentially affected by CVE-2026-47429 via vitest (>=4.0.0-beta.7, <=4.0.18)

vitest NPM version =4.0.0-beta.7, =0.79.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.0-alpha.31, =2.1.0, =1.2.3-preview-a960555.0, =7.2.0, =11.0.33, =21.0.0-alpha.33, =23.0.0-alpha.1 - @forsakringskassan/vitest-config 1.1.0 and more Source cves...

@0xshogun/sdk (>=1.1.44, <=1.1.52), @0xshogun/sdk-react (>=1.1.14, <=1.1.65) +9 more potentially affected by CVE-2026-47429 via @vitest/ui (>=3.0.7, <=3.2.4)

@vitest/ui NPM version =3.0.7, =1.1.44, =1.1.14, =0.5.0, =1.0.388, =21.0.0-alpha.26, =1.1.52, =1.1.65, =1.0.0, =7.0.5, =0.9.9, =0.10.4 Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTUI-17120328...

@astralis-os/vitest (2.4.1), @aws/nx-plugin (>=0.79.1, <=0.84.2) +75 more potentially affected by CVE-2026-47429 via vitest (>=4.0.0-beta.7, <=4.0.18)

vitest NPM version =4.0.0-beta.7, =0.79.1, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.0-alpha.31, =2.1.0, =1.2.3-preview-a960555.0, =7.2.0, =11.0.33, =21.0.0-alpha.33, =23.0.0-alpha.1 - @forsakringskassan/vitest-config 1.1.0 and more Source cves...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.249, <=2.1.0-alpha.251) +7 more potentially affected by CVE-2026-47429 via @vitest/browser (>=3.0.5, <=3.2.4)

@vitest/browser NPM version =3.0.5, =0.0.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =3.8.0, =1.0.1, =0.0.2, =0.0.5 Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTBROWSER-17120327...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @24hr/ettapi (>=0.2.4, <=0.2.5) +100 more potentially affected by CVE-2026-47429 via vitest (>=3.0.2, <=3.2.4)

vitest NPM version =3.0.2, =0.0.1, =0.2.4, =0.5.0, =2.2.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =0.0.0, =4.0.0-alpha.5, =0.1.2-next.95, =1.0.0, =1.0.2 - @chrom-ar/solver-sdk 1.0.2 and more Source cves: CVE-2026-47429 Source advisory:...

@baic/preset-yolk-taro-miniprogram (>=2.1.0-alpha.278, <=2.1.0-alpha.281), @baic/preset-yolk-umi-mobile (>=2.1.0-alpha.278, <=2.1.0-alpha.281) +8 more potentially affected by CVE-2026-47429 via @vitest/browser (>=4.0.0, <=4.0.18)

@vitest/browser NPM version =4.0.0, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =2.1.0-alpha.278, =4.0.0-beta.15, =4.0.0-beta.15, =4.0.0-beta.15, =0.5.0-rc.1, =0.1.0, =0.2.0-alpha.4 Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTBROWSER-17120327...

@etherna/sdk-js (>=2.0.1, <=2.0.3), @eui/deps-base (>=21.0.0-alpha.33, <=23.0.0-alpha.1) +14 more potentially affected by CVE-2026-47429 via @vitest/ui (>=4.0.3, <=4.0.18)

@vitest/ui NPM version =4.0.3, =2.0.1, =21.0.0-alpha.33, =1.3.0, =0.3.5, =0.3.0, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.3.5, =0.4.2 and more Source cves: CVE-2026-47429 Source advisory: SNYK:JS-VITESTUI-17120328...

@1771technologies/oneplay (>=0.0.1, <=0.0.6), @24hr/ettapi (>=0.2.4, <=0.2.5) +100 more potentially affected by CVE-2026-47429 via vitest (>=3.0.2, <=3.2.4)

vitest NPM version =3.0.2, =0.0.1, =0.2.4, =0.5.0, =2.2.1, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =2.1.0-alpha.249, =0.0.0, =4.0.0-alpha.5, =0.1.2-next.95, =1.0.0, =1.0.2 - @chrom-ar/solver-sdk 1.0.2 and more Source cves: CVE-2026-47429 Source advisory:...

@leav/ui (>=1.13.0-0ceda52e, <=1.14.0) potentially affected by CVE-2026-47423 via dompurify (3.4.4)

dompurify NPM version 3.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on dompurify and may be impacted: - @leav/ui =1.13.0-0ceda52e, =1.14.0 Source cves: CVE-2026-47423 Source advisory: OSV:GHSA-87XG-PXX2-7HVX...