39 matches found
SurrealDB: Custom API route lets authenticated callers override namespace/database scope via URL path
An authenticated user scoped to one namespace/database could invoke a custom API DEFINE API belonging to a different namespace/database, reaching another tenant's endpoint. The route /api/namespace/database/endpoint took the namespace and database from the URL and applied them to the caller's...
JLSEC-2026-1346 GNU Bison improperly handles grammarâdefined output paths. Grammar directives such as %output and...
GNU Bison improperly handles grammarâdefined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override callerâsupplied output options. When processing attacker-supplied grammar, this behavior allows directing...
CVE-2026-73424 Astro: Unauthenticated path override in the @astrojs/vercel ISR function
Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts xastropath for the public /isr function based only on the x-vercel-isr header, allowing unauthenticated GET requests to...
EUVD-2026-54723
Ruby LSP is an implementation of the language server protocol for Ruby. Several workspace-level settings in the Ruby LSP VS Code extension prior to version 0.10.4 could override the path to the Ruby executable, the version manager executables, or the Bundler Gemfile used at startup. A malicious...
CVE-2026-69259
Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the SQLite Record Manager node in packages/components/nodes/recordmanager/SQLiteRecordManager/SQLiteRecordManager.ts accepted user-controlled additionalConfig and spread it after the intended...
Arbitrary Code Injection
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input, which allows overriding the intended SQLite database path. An attacker can achieve arbitrary code execution by crafting a malicious payload that writ...
Arbitrary Code Injection
Overview flowise-components is a Flowiseai Components Affected versions of this package are vulnerable to Arbitrary Code Injection via the additionalConfig input, which allows overriding the intended SQLite database path. An attacker can achieve arbitrary code execution by crafting a malicious...
CVE-2026-56390
GNU Bison improperly handles grammarâdefined output paths. Grammar directives such as %output and %header allow specifying file paths, which are accepted without restriction and override callerâsupplied output options. When processing attacker-supplied grammar, this behavior allows directing...
GHSA-X27W-589X-FRM2 Astro: Unauthenticated path override in the @astrojs/vercel ISR function
Summary When ISR is enabled, the serverless entrypoint lets an unauthenticated request decide which route the origin renders. The internal isr function reads the xastropath query parameter and rewrites the request path to it without any authentication. Edge level access controls only ever see the...
Duplicate Advisory: Custom API route lets authenticated callers override namespace/database scope via URL path
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-848m-r628-vrxw. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.2.0 fail to validate namespace and database scope in custom API routes, allowing...
TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint
Impact The /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the TensorZero objectstorage configuration. By abusing the filesystem storage type, a caller can read arbitrary files from the gateway filesystem, including files that may...
PT-2026-59068
Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.py Summary BabelDOC's vendored PDF parser babeldoc/pdfminer/cmapdb.py deserializes untrusted pickle data when loading CMap files. The load data method strips only NUL bytes from a PDF-controlled CMap name, then...
CVE-2026-56813 Cookie attribute injection in Plug.Conn.Cookies.encode/2
Improper Neutralization of Parameter/Argument Delimiters vulnerability in elixir-plug plug allows an attacker to inject or override HTTP cookie attributes. The Plug.Conn.Cookies.encode/2 function in lib/plug/conn/cookies.ex builds the Set-Cookie response header by interpolating the cookie value a...
NPM: pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
NPM: pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.0...
EulerOS Virtualization 2.12.1 : libssh (EulerOS-SA-2026-2080)
According to the versions of the libssh package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A weakness has been identified in libssh up to 0.11.3. The impacted element is the function...
PT-2026-45033
Name of the Vulnerable Software and Affected Versions Ouroboros versions prior to 0.39.0 Description A Remote Code Execution issue exists when the software loads a .env file from the current working directory. An attacker can include a malicious script in a repository and use environment variable...
Apache Polaris has an Improper Input Validation Issue
Apache Polaris can issue broad temporary "vended" storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation...
CVE-2026-42809
Apache Polaris can issue broad temporary "vended" storage credentials during staged table creation before the effective table location has been validated or durably reserved. Those temporary credentials are meant to limit the scope of accessible table data and metadata, but this scope limitation...
Untrusted Search Path
Overview openclaw is a ðŠ OpenClaw â Personal AI Assistant Affected versions of this package are vulnerable to Untrusted Search Path in the installation of local plugins or hooks, specifically when executing npm install --omit=dev --silent --ignore-scripts within a staged directory that may contai...
AZL-81098 CVE-2026-0964 affecting package libssh for versions less than 0.10.6-7
A malicious SCP server can send unexpected paths that could make the client application override local files outside of working directory. This could be misused to create malicious executable or configuration files and make the user execute them under specific consequences. This is the same issue...