Directory Traversal

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Directory Traversal via the downloadURLgifimage parameter in the GIF poster upload process. An attacker can access and disclose arbitrary server-local files by...

PraisonAI path traversal vulnerability

PraisonAI is a low-code multi-agent collaboration framework developed by Mervin Praison. Versions of PraisonAI prior to 1.5.113 contained a path traversal vulnerability. This vulnerability stemmed from the template installation feature’s use of Zip Slip for arbitrary file writing. When downloadin...

LibreChat path traversal vulnerability

LibreChat is an open-source, free, and highly customizable unified AI dialogue platform. It allows for the aggregation and running of large models from any vendor within a single interface. Prior to LibreChat 0.8.4, there was a path traversal vulnerability. This vulnerability stemmed from trustin...

Group Office Code Issues and Vulnerabilities

Group Office is a modular office suite developed by the Dutch company Group Office. Versions of Group Office prior to 6.8.156, 25.0.90, and 26.0.12 contained code vulnerabilities. These vulnerabilities stemmed from insecure deserialization in the AbstractSettingsCollection model, which could allo...

Langflow Access Control Vulnerability

Langflow is an open-source visualization framework developed by Langflow for building multi-agent and RAG applications. Versions of Langflow from 1.2.0 to 1.8.1 contain access control vulnerability issues. This vulnerability stems from the lack of boundary checks at the underlying storage layer,...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the git resolver process. An attacker can access arbitrary files on the resolver pod by supplying crafted path input. Details A Directory Traversal attack also known as path traversal aims to access files and...

Pegasystems Pega Robot Studio security vulnerabilities

Pegasystems Pega Robot Studio is an RPA Robotic Process Automation integration development environment provided by Pegasystems Corporation in the United States. There is a security vulnerability in Pegasystems Pega Robot Studio. This vulnerability stems from the possibility of arbitrary file...

Stirling-PDF security vulnerability

Stirling-PDF is a powerful, locally hosted web-based PDF manipulation tool developed by Stirling Tools and open source using Docker. Versions of Stirling-PDF prior to 2.5.2 contained a security vulnerability due to the lack of path checking in the/api/v1/convert/markdown/pdf endpoint, which could...

CVE-2026-29098: Relative Path Traversal

SuiteCRM is an open-source, enterprise-ready Customer Relationship Management CRM software application. Prior to versions 7.15.1 and 8.9.3, the actionexportCustom function in modules/ModuleBuilder/controller.php fails to properly neutralize path traversal sequences in the $modules and $name...

ApostropheCMS path traversal vulnerability

ApostropheCMS is a full-stack content management system open source by Apostrophe Technologies. Versions of ApostropheCMS prior to 3.5.3 had a path traversal vulnerability. This vulnerability stemmed from unparsed sections of path connections, which could lead to arbitrary file writing...

Adobe DNG Software Development Kit Integer Overflow DoS

The vulnerability of the Adobe DNG Software Development Kit’s file reading and writing software is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to cause a service failure using a specially created file...

Vaida security vulnerabilities

Vaadin is an open-source platform for web application development developed by Vaadin contributors. The Vaadin platform includes a set of web components, a Java web framework, as well as a set of tools and application starters. Vulnerabilities exist in Vaadin versions 14.14.0 and earlier, 23.6.6...

OESA-2026-1488 hsqldb security update

HSQLdb is a relational database engine written in JavaTM , with a JDBC driver, supporting a subset of ANSI-92 SQL. It offers a small about 100k, fast database engine which offers both in memory and disk based tables. Embedded and server modes are available. Additionally, it includes tools such as...

HP System Event Utility security vulnerabilities

HP System Event Utility is a system application developed by Hewlett-Packard HP in the United States, designed to deliver official notifications to systems. There is a security vulnerability in HP System Event Utility, which may lead to denial-of-service attacks and allow for arbitrary file writi...

Google Web Designer security vulnerabilities

Google Web Designer is a professional HTML5 advertising and web content creation tool developed by Google Inc. It supports both visual design and code editing. Google Web Designer has a security vulnerability, which stems from the Zip Slip vulnerability. This vulnerability may lead to arbitrary...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the music/playlists/update API endpoint. An attacker can execute arbitrary code by bypassing file extension enforcement and writing malicious files to arbitrary locations on the filesystem, such...

PT-2026-21309

delpino73 Blue-Smiley-Organizer 1.32 contains an SQL injection vulnerability in the datetime parameter that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL code through POST requests to extract sensitive data using boolean-based blind and time-based blind...

Adobe DNG Software Development Kit Integer Overflow Code Execution

The vulnerability of the Adobe DNG Software Development Kit’s file reading and writing software is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created file...

MarkUs security vulnerabilities

MarkUs is an open-source Ruby on Rails and React web application used for submitting and grading student assignments. Versions of MarkUs prior to 2.9.1 contained a security vulnerability due to insufficient file path checking, which could allow arbitrary file writing...

Microsoft Semantic Kernel path traversal vulnerability

Microsoft Semantic Kernel is a large-scale model orchestration framework developed by Microsoft Corporation. Versions of Microsoft Semantic Kernel prior to 1.70.0 contained a path traversal vulnerability, which was caused by an arbitrary file writing vulnerability in the SessionsPythonPlugin...