CVE-2026-61443

PraisonAI prior to 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() due to lack of path containment validation. This allows attackers to supply absolute file paths and execute arbitrary scripts from any filesystem location, including outside the intended work...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

FreeBSD : FreeBSD -- unlinkat(2) ignores AT_RESOLVE_BENEATH flag (33fd66d1-74e2-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 33fd66d1-74e2-11f1-958d-bc241121aa0a advisory. The kernel function that implements unlinkat2 and funlinkat2 validated the ATRESOLVEBENEATH flag but...

DEBIAN-CVE-2026-44837

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path...