CVE-2026-112937

A flaw was found in filelock. When the ReadWriteLock component cleans up internal lock directories, it does not safely verify the target before removal. A local attacker with write access to a shared directory can substitute an arbitrary directory in place of the expected cleanup path. This...

CVE-2026-64672

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink alread...

CVE-2026-64672 Terragrunt catalog predictable temp symlink clobber

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.1.1, the terragrunt catalog command derives a predictable per-repository catalog clone root under the shared system temporary directory and follows a symlink alread...

CVE-2026-42048

CVE-2026-42048 CVE-2026-42048 Langflow Path Traversal / Arbitrary Directory Deletion PoC https://github.com/user-attachments/assets/6e5481ff-e953-47a5-8870-70b30c6550de Description CVE-2026-42048 : Langflow Arbitrary Directory Deletion Vulnerability description: A path traversal vulnerability in...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.20 security and extras update

Red Hat OpenShift Container Platform release 4.22.20 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

Filelock: ReadWriteLock On The Hard-link Route Deletes Any Directory Another User Renames Onto Its .filelock-* Link Dire

"ReadWriteLock" and "AsyncReadWriteLock" the SQLite-backed reader/writer lock remove their private ".filelock-" link directories with "shutil.rmtree" a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link rout...

Amazon Linux 2 : perl-YAML (ALAS-2026-4035)

The version of perl-YAML installed on the remote host is prior to 0.84-5. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-4035 advisory. YAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classes. A...

filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock remove their private .filelock- link directories with shutil.rmtree a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route a hard...

GHSA-JQC4-5CVW-7W85 filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name

ReadWriteLock and AsyncReadWriteLock the SQLite-backed reader/writer lock remove their private .filelock- link directories with shutil.rmtree a recursive delete on a remembered path. They do not check that the path still names the directory they created. This happens on the hard-link route a hard...

CVE-2026-57113

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer late...

CVE-2026-57113 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer late...

CVE-2026-57113

PraisonAI versions 2.6.0 through 4.6.57 are vulnerable to a path traversal flaw in the template loader. The system accepts GitHub template URIs with refs but stores the user-controlled path and ref verbatim without normalization. Because the cache layer joins these values into a filesystem path w...

CVE-2026-57113 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer late...

CVE-2026-57113 PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion

PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-controlled template path and ref verbatim, and the cache layer late...

prime-mover-cves

Prime Mover WordPress — CVE Writeups Three vulnerabilities...

CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114492

The gin-vue-admin framework (versions through 2.9.2 ) is vulnerable to a path traversal vulnerability in the /autoCode/removePlugin endpoint. An authenticated administrator can send a crafted POST request containing ../ sequences in the pluginName parameter, triggering the os.RemoveAll function. ...

CVE-2026-114492 gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

SUSE CVE-2026-112937

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, ReadWriteLock can remove a randomized .filelock- private-hard-link directory during cleanup, allowing another local user with rename access in a non-sticky parent to observe a live name or forge a dead-owner sweep na...