CVE-2026-118758 Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify a...

EUVD-2026-113214

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify a...

CVE-2026-118758

Kubeflow Pipelines versions prior to 2.18.0 are vulnerable to an unauthenticated path traversal vulnerability in the volume artifact handler for GET /artifacts/get?source=volume. The root cause is a failure to confine caller-supplied file paths to the selected volume, allowing an attacker to read...

CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

CVE-2026-119145

The Frappe platform (versions before 15.121.0 and 16.x before 16.34.0 ) is vulnerable to a path traversal vulnerability. The root cause is that certain file-upload handling mechanisms fail to validate the destination path before writing to the disk. This allows authenticated attackers to upload c...

CVE-2026-119145 Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

EUVD-2026-113212

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

CVE-2026-119135

The Wasmtime runtime (versions 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3) is vulnerable to a panic during the host-to-host read path. The root cause is that the host asserts matching TypeIds instead of returning an error when reading a component model stream as a different Rust item type than...

CVE-2026-119135 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Panic via StreamReader Type Mismatch

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created...

EUVD-2026-113202

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created...

CVE-2026-119131 Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 Host Panic via wasi-http

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and...

CVE-2026-119130 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

CVE-2026-119130

The Wasmtime runtime (versions before 36.0.18 , 37.0.0 before 48.0.6 , and 49.0.0 before 49.0.3 ) is vulnerable to an HTTP Request Target Smuggling issue. The root cause is a failure to verify that set-path-with-query values in wasmtime-wasi-http are valid paths. Consequently, absolute-form URLs ...

EUVD-2026-113197

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

CVE-2026-119130 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 HTTP Request Target Smuggling

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

CVE-2026-90871 Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server

Improper limitation of a pathname to a restricted directory in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory...

CVE-2026-90871

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows are vulnerable to a path traversal vulnerability (CWE-22, CWE-73). This improper limitation of a pathname to a restricted directory could allow an unauthenticated attacker to affect files outside the intended direc...

CVE-2026-90866

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows are affected by a path traversal vulnerability. This flaw allows a delegated Host Administrator to bypass virtual folder path confinement and access locations outside their authorized scope, which could potentially...

CVE-2026-90866 Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

EUVD-2026-113023

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...