Langflow < 1.9.1 - Unauthenticated File Upload

Langflow 1.9.1 contains an unrestricted file upload caused by lack of upload limitations, letting unauthenticated attackers exhaust server space and leak absolute file paths, exploit requires network access. id: CVE-2026-55450 info: name: Langflow 1.9.1 - Unauthenticated File Upload author: xtr0n...

QSAN Storage Manager <3.3.3 - Cross-Site Scripting

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. id: CVE-2021-37216 info: name: QSAN Storage Manager 3.3.3 - Cross-Site...

Progress ShareFile Storage Zones Controller - Authentication Bypass

Customer Managed ShareFile Storage Zones Controller SZC contains an authentication bypass Execution After Redirect that allows unauthenticated attackers to access restricted configuration pages. This leads to changing system configuration and potential remote code execution. id: CVE-2026-2699 inf...

CVE-2026-19270

Hulupeep mcp-ui-probe up to 0.2.0 contains a local path-traversal vulnerability in Journey/Usage’s JourneyStorage.ts. The affected functions—get_journey, delete_journey, analyze_journey, and usage_stats—manipulate journeyId/filename to access unintended paths. The issue requires local access; no ...

CVE-2026-19270

A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function getjourney/deletejourney/analyzejourney/usagestats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path...

Vendure - Arbitrary File Read

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CVE-2026-47363

In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity accepts an attacker-supplied session including OAuth tokens from Intent extras with no permission guard, and signs the app into that session without validating it against the backend. Th...

CVE-2026-47363

The CVE-2026-47363 describes a vulnerability in the Datadog Android app where the launcher activity AppActivity is exported with no permission guard and launchMode=singleTask. On every onCreate/onNewIntent, an extension (Intent.getUserSession()) deserializes a full UserSession (including user ide...

CVE-2026-47362

In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sensitive content in plaintext: LocalNotificationDatabase notification title, message, recipient, service, tags, and on-call/incident deep links and SearchRecentDatabase the user's full in-a...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

go-git: Malicious reference names may modify files outside the reference storage

Impact A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage. Loose references are stored under .git/. The reference name was previously used as a path without verifying that the resolved path remained within the...

GHSA-QGQ7-7HM3-Q39J go-git: Malicious reference names may modify files outside the reference storage

Impact A path traversal issue in go-git could allow malicious reference names to access files outside the repository's intended reference storage. Loose references are stored under .git/. The reference name was previously used as a path without verifying that the resolved path remained within the...

CVE-2026-71557

CVE-2026-71557 affects the go-git library (pure Go). The vulnerability occurs when reference names are not sanitized before being used to build on-disk paths under the reference storage directory, allowing malicious reference names (e.g., containing directory traversal sequences) to cause writes ...

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-71557 go-git: Malicious reference names may modify files outside the reference storage

go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name for example containing...

CVE-2026-54205

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54205

The vulnerability CVE-2026-54205 affects Tobit Laboratories AG TeamDavid’s Webbox link-storing functionality. The server-side code accepts a pathname parameter that can be a UNC network location (e.g., \Server\Share) without validation, causing outbound connections to attacker-controlled SMB endp...

CVE-2026-54218 TeamDavid: Weak Cryptography and Insecure Password Storage

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...

CVE-2026-54218

CVE-2026-54218 affects Tobit Laboratories AG TeamDavid’s Webbox. The issue stems from use of a hard-coded cryptographic key and password storage across locally created users in David, where passwords are stored in various files using only obfuscation. If an attacker can access the server’s file s...