GHSA-5XF7-4P34-54QR vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-44763

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on condition...

EUVD-2025-210676

The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to...

EUVD-2026-55863

SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on condition...

SUSE CVE-2026-15059

Local unprivileged users can terminate arbitrary local processes via a systemd-oomd IPC API due to a missing path traversal validation...

PT-2026-70770

Name of the Vulnerable Software and Affected Versions Microsoft PowerShell Core affected versions not specified Description A relative path traversal issue exists that allows an unauthorized attacker to execute code over a network. Path traversal is a flaw that allows an attacker to access files ...

PT-2026-70695

Name of the Vulnerable Software and Affected Versions .NET Framework affected versions not specified Description A relative path traversal issue allows an unauthorized attacker to elevate privileges locally on the system. Recommendations At the moment, there is no information about a newer versio...

PT-2026-70666

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network...

PT-2026-70337

Name of the Vulnerable Software and Affected Versions gaudi-container-runtime versions prior to 1.24.0 Description A path traversal issue exists within Ring 3: User Applications, which may allow an authenticated, unprivileged software adversary to escalate privileges. This can occur via local...

PT-2026-70103

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal vulnerability exists in the Offline archives functionality of the local web interface. This issue occurs because of insufficient validation of a...

PT-2026-70146

Name of the Vulnerable Software and Affected Versions AsyncFuncAI deepwiki-open versions prior to commit 16f35a0 Description A path traversal issue allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths. This occurs via the 'local-repository structure'...

VulnCheck KEV: CVE-2026-33497

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.1, in the downloadprofilepicture function of the /profilepictures/foldername/filename endpoint, the foldername and filename parameters are not strictly filtered, which allows the secretkey to be re...

PT-2026-70236

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata file...

PT-2026-70819

Name of the Vulnerable Software and Affected Versions Lightroom Classic affected versions not specified Description An Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal, allows for arbitrary file system read. This issue enables an attacker to access sensiti...

PT-2026-70214

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2024 SU7 Description An issue in the Core of the software allows a remote authenticated attacker to gain full write control over an S3 bucket used for session recording storage. This is caused by...

PT-2026-70023

Name of the Vulnerable Software and Affected Versions SAP Manufacturing Integration and Intelligence affected versions not specified Description Insufficient file path validation in certain functions allows a privileged attacker to use specially crafted input to write files outside the intended...

PT-2026-70879

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious RDP server to write attacker-controlled content outside the selected save directory because the RDP clipboard download path in...

PT-2026-70148

Name of the Vulnerable Software and Affected Versions Intelliants Subrion CMS versions prior to 4.2.2 Description An authenticated administrator can delete arbitrary files on the server through the admin panel file deletion endpoint. This occurs because the endpoint passes a user-supplied file pa...

PT-2026-70077

Name of the Vulnerable Software and Affected Versions ManageEngine M365 Manager Plus versions prior to 4820 ManageEngine M365 Security Plus versions prior to 4820 Description An authenticated path traversal issue exists within the Exchange Online backup module. Path traversal is a flaw that allow...

PT-2026-70870

Name of the Vulnerable Software and Affected Versions insights-client affected versions not specified Description A flaw exists where a compromised managed cluster, known as a spoke, can inject unencoded data into the Insights API URL path. This happens because the ClusterID variable, which is...