CVE-2026-73083: Protection Mechanism Failure

Activepieces is an open source AI workflow automation platform. Prior to 0.80.0, in SANDBOXCODEONLY mode, the engine loads the compiled user module with importFresh, a wrapper around Node.js require, before the V8 isolate is applied. Top-level module code can therefore call require'childprocess',...

PT-2026-70551

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to elevate privileges locally on the system. Recommendations At the moment...

CVE-2026-69109: Path Traversal: '.../...//'

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

PT-2026-70196

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

Util-linux Symbolic Link Access

The vulnerability of the Util-linux command-line utility package relates to the incorrect definition of symbolic links before accessing the file. Exploiting this vulnerability can allow an attacker to gain access to confidential data...

PT-2026-70518

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to elevate privileges locally on the system. Recommendations At the moment...

PT-2026-70550

Name of the Vulnerable Software and Affected Versions Windows DHCP Server affected versions not specified Description Improper link resolution before file access, also known as link following, allows an authorized attacker to elevate privileges locally on the system. Recommendations At the moment...

PT-2026-70783

Name of the Vulnerable Software and Affected Versions Windows Container Isolation FS Filter Driver unionfs.sys affected versions not specified Description Improper link resolution before file access, known as link following, occurs in the unionfs.sys driver. This allows an authorized attacker to...

Siemens LOGO! Soft Comfort

SUMMARY Siemens LOGO! Soft Comfort contains multiple vulnerabilities in its project-file encryption and password handling mechanisms. A local attacker could exploit these vulnerabilities to extract the master key, allowing them to decrypt project data or remove project passwords. The lack of...

UBUNTU-CVE-2026-73030

unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...

GHSA-55Q2-FJHQ-7XH7 vulnerabilities

Vulnerabilities for packages: jupyter-base-notebook, langfuse, nextcloud-server...

GHSA-F23P-VX2J-J53R vulnerabilities

Vulnerabilities for packages: langfuse-fips, wazuh-dashboard-fips, commercial-gitlab-rails-ee-fips, wazuh-dashboard, langfuse, kibana, commercial-gitlab-rails-ee...

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

CVE-2026-71962 Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download

Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global authentication whitelist, which bypass...

Incorrect Authorization

Overview org.apache.tapestry:tapestry-core is a Tapestry Core package for Apache Tapestry. Affected versions of this package are vulnerable to Incorrect Authorization via specially crafted URLs in the tapestry-core. An attacker can access sensitive files from the classpath by manipulating the URL...

CVE-2026-72691 OpenSignLabs opensignserver - Authentication Bypass

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...

CVE-2026-72691 OpenSignLabs opensignserver - Authentication Bypass

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTERKEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever an...

CVE-2026-72577

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-17540

The File Manager WordPress plugin before 6.9.1 does not properly authorise its file management commands, allowing any authenticated user, such as a subscriber, to read and delete arbitrary files under the WordPress installation directory, which could lead to the disclosure of the site's...

PT-2026-69832

Name of the Vulnerable Software and Affected Versions opensignserver versions prior to 2.37.1 Description An authentication bypass exists in the getsignedurl Parse cloud function. The function fails to perform the isAuthenticated check when a docId parameter is provided, regardless of whether the...