PT-2026-107317

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description A remote authenticated attacker can obtain sensitive information because the software does not properly limit pathnames to a restricted directory, leading to a path traversal issue...

PT-2026-106821

Name of the Vulnerable Software and Affected Versions @quasar/icongenie versions prior to 6.1.1 Description The icongenie generate --profile command fails to constrain the resolved destination to the Quasar project directory when processing folder and name values from a user-supplied profile. The...

CVE-2026-105834: Improper Limitation of a Pathname to a Restricted Directory

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

PT-2026-106716

Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the...

PT-2026-107272

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 0.6.17 Description The @backstage/plugin-proxy-backend package contains improper input validation within the proxy-backend. An authenticated user can craft a request URL that forces the proxy-backend to forward the...

PT-2026-107278

Name of the Vulnerable Software and Affected Versions Backstage versions prior to 1.54.6 Description Cloud storage catalog providers do not sufficiently validate object paths. A principal with permissions to create or rename objects in a configured AWS S3 or Azure Blob Storage catalog source can...

Security Advisory 0189

Security Advisory 0189 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release Description All CVEs covered in this advisory affect platforms running CloudVision Portal On-Premises, where insufficient validations in the Software Management...

Security Advisory 0188

Security Advisory 0188 . CSAF PDF Date: October 6, 2026 Revision | Date | Changes ---|---|--- 1.0 | October 6, 2026 | Initial release The CVE-ID tracking this issue: CVE-2026-101153 CVSSv3.1 Base Score: 8.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H CVSSv4.0 Base Score: 7.2...

CVE-2026-106552: Relative Path Traversal

In sftp in OpenSSH before 10.6, a server can trigger directory traversal causing files to be written to unintended locations during a recursive copy operation...

uv: Path traversal on Windows through wheel extraction

Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...

GHSA-2CV4-CQWR-GWF7 uv: Path traversal on Windows through wheel extraction

Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present o...

EUVD-2026-90363

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup...

Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

GHSA-5639-2J2P-M4MX Mako: Path traversal via drive-letter URI on Windows in TemplateLookup

Summary On Windows, a TemplateLookup URI beginning with a drive designator e.g. C:/../../secret.txt or C:....\secret.txt bypasses the directory traversal check in Template.init, allowing reads of files outside the configured template directory. This is a third, independent instance of the root...

Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

NPM: Nx: Path traversal in nx migrate package-migrations extraction

NPM: Nx: Path traversal in nx migrate package-migrations extraction vulnerability discovered by ? in WordPress Npm nx versions = 13.10.0, 22.7.10...

EUVD-2026-91761

Nx: Path traversal in nx migrate package-migrations extraction...

GHSA-HRVQ-X7JP-36XV Nx: Path traversal in nx migrate package-migrations extraction

Summary nx migrate reads each target package's nx-migrations.migrations value from its manifest and extracts the referenced file to a path built by joining that value onto a temporary directory. The value is never validated, so a package whose migrations field contains .. segments or an absolute...

GHSA-5H3F-Q97H-CCVC vm2: NodeVM custom resolution bypasses external path boundaries

Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...

Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows

A Path Traversal vulnerability exists in the prerendered SSG page retrieval logic of CommonEngine in @angular/ssr/node and @angular/ssr in earlier versions. When deployed on Windows, an attacker can craft a request path with backslash directory traversal sequences that causes CommonEngine to serv...