IBM Langflow Desktop 路径遍历漏洞

IBM Langflow Desktop is a desktop application for AI process orchestration developed by IBM. Versions 1.2.0 to 1.8.4 of IBM Langflow Desktop contain a path traversal vulnerability. This vulnerability stems from directory traversal issues, which may allow authenticated attackers to send specially...

africa.absa:inception-application (>=1.1.0 <=1.2.0), africa.absa:inception-test (>=1.1.0 <=1.2.0) +2768 more potentially affected by CVE-2026-22745 via org.springframework:spring-webflux (>=5.0.0.RELEASE <=5.3.4)

org.springframework:spring-webflux MAVEN version =5.0.0.RELEASE, =1.1.0, =1.1.0, =0.5.0, =0.5.0, =0.5.0, =j8.2.2.0, =0.0.1, =v0.3.12, =v0.3.10, =v0.3.12, =2.1.2.RELEASE, =4.1.36, =4.1.7, =4.7.1 - br.com.m4rc310:br-com-m4rc310-graphql =1.0.1 - br.com.m4rc310:br-com-m4rc310-libs =1.0.1 and more...

a-mailx (=0.1.0), a-move-files-by-excel (>=0.1.0 <=0.1.1) +4203 more potentially affected by CVE-2026-41066 via lxml (>=3.2.3 <=6.0.4)

lxml PYPI version =3.2.3, =0.1.0, =0.1.0, =0.1.0, =0.9.1, =1.0.2, =0.1.0, =0.3.0, =0.3.5, =0.3.0, =0.3.0, =0.1.1, =0.1.0, =0.1.0, =0.5.0 and more Source cves: CVE-2026-41066 Source advisory: OSV:GHSA-VFMQ-68HX-4JFW...

CVE-2026-35074

Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7.0.0, LTS2025 release versions 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13.1.0 through 7.13.1.60 contain an improper neutralization of special elements used in an OS Command Injection vulnerability. A high privileged attacker...

PT-2026-33444

Name of the Vulnerable Software and Affected Versions Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions 7.7.1.0 through 8.5 Dell PowerProtect Data Domain with Data Domain Operating System DD OS versions 8.3.1.0 through 8.3.1.20 Dell PowerProtect Data Domain with Data...

CVE-2026-40090 Zarf has a Path Traversal via Malicious Package Metadata.Name — Arbitrary File Write

Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom and zarf package inspect documentation subcommands. These subcommands output file paths are constructed by joining a...

SUSE CVE-2026-35205

Helm is a package manager for Charts for Kubernetes. From 4.0.0 to 4.1.3, Helm will install plugins missing provenance .prov file when signature verification is required. This vulnerability is fixed in 4.1.4...

CVE-2026-4788 Multiple Vulnerabilities affect IBM Tivoli Netcool Impact

IBM Tivoli Netcool Impact 7.1.0.0 through 7.1.0.37 stores sensitive information in log files that could be read by a local user...

corradin-opioid-project (=0.1.0), eensight (>=1.0.0 <=1.0.2) +48 more potentially affected by CVE-2026-35171 via kedro (>=0.15.9 <=1.0.0)

kedro PYPI version =0.15.9, =1.0.0, =0.1.0, =0.1.0, =0.1.9, =0.1.0, =0.0.4, =0.1.0, =0.2.1, =0.1.0, =0.1.0, =0.3.0, =0.5.1 and more Source cves: CVE-2026-35171 Source advisory: OSV:PYSEC-2026-72...

agent-evaluator (=0.7.8), apppy-app (>=0.1.0 <=0.24.1) +61 more potentially affected by CVE-2026-35526 via strawberry-graphql (>=0.202.1 <=0.312.0)

strawberry-graphql PYPI version =0.202.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.1.0, =0.0.33, =0.9.0, =25.13.0, =0.41.0, =1.2.0, =0.1.0a1, =1.1.20, =2.1.1 - dictatorgenai =0.1.0 and more Source cves: CVE-2026-35526 Source advisory: OSV:GHSA-HV3W-M4G2-5X77...

01os (>=0.0.5 <=0.0.13), 3m (>=0.1.0 <=0.1.3) +2585 more potentially affected by CVE-2026-33699 via pypdf (>=3.10.0 <=6.9.1)

pypdf PYPI version =3.10.0, =0.0.5, =0.1.0, =0.0.1, =0.2.0, =0.4.0, =0.3.0, =0.3.0, =0.1.1, =0.1.0, =0.0.2, =0.2.0, =1.2.27, =3.0.145 and more Source cves: CVE-2026-33699 Source advisory: OSV:GHSA-87MJ-5GGW-8QC3...

org.webjars.npm:unhead__vue (>=1.11.20 <=2.1.10), org.webjars.npm:vueuse__head (=1.0.22) potentially affected by CVE-2026-31860 via org.webjars.npm:unhead (>=1.11.20 <=2.1.10)

org.webjars.npm:unhead MAVEN version =1.11.20, =1.11.20, =2.1.10 - org.webjars.npm:vueusehead =1.0.22 Source cves: CVE-2026-31860 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15627228...

airflow-clickhouse-plugin (>=1.3.0 <=1.4.0), airflow-dagfactory (=0.19.1) +28 more potentially affected by CVE-2025-69219 via apache-airflow-providers-http (>=5.2.1 <=6.0.0)

apache-airflow-providers-http PYPI version =5.2.1, =1.3.0, =0.0.1, =0.0.9, =0.9.2, =2.9.0, =1.0.0, =0.1.34, =2.10.3, =1.7.3, =1.8.0rc2, =4.3.0, =5.1.1 and more Source cves: CVE-2025-69219 Source advisory: SNYK:PYTHON-APACHEAIRFLOWPROVIDERSHTTP-15441017...

2sio (>=0.1.0 <=1.13.0), 4mica-x402 (>=0.1.0 <=1.2.3) +53 more potentially affected by unknown CVE via x402 (>=0.2.1 <=2.12.0)

x402 PYPI version =0.2.1, =0.1.0, =0.1.0, =0.2.0, =1.0.0, =0.0.15, =0.3.14, =0.1.0, =0.1.1, =0.7.0, =0.5.4, =0.1.0, =0.1.0, =0.1.1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-QR2G-P6Q7-W82M...

ai-dynamo (>=0.1.0 <=0.3.0), bento-sgl-router (>=0.0.1 <=0.0.6) +32 more potentially affected by CVE-2026-27905 via bentoml (>=0.10.1 <=1.4.8)

bentoml PYPI version =0.10.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.2.3, =0.1.0, =0.0.1, =0.0.10, =0.1.0, =0.2.0, =0.0.5, =0.1.1 - fusionmllib =0.1.0 - kazemlstack =0.1.0 and more Source cves: CVE-2026-27905 Source advisory: SNYK:PYTHON-BENTOML-15372202...

PT-2026-22815

IBM MQ 9.1.0.0 through 9.1.0.33 LTS, 9.2.0.0 through 9.2.0.40 LTS, 9.3.0.0 through 9.3.0.36 LTS, 9.30.0 through 9.3.5.1 CD, 9.4.0.0 through 9.4.0.17 LTS, and 9.4.0.0 through 9.4.4.1 CD...

vantuz (>=3.3.2 <=3.3.7) potentially affected by CVE-2026-28453 via openclaw (=0.0.1)

openclaw NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on openclaw and may be impacted: - vantuz =3.3.2, =3.3.7 Source cves: CVE-2026-28453 Source advisory: OSV:GHSA-P25H-9Q54-FFVW...

CVE-2025-0976

Information Exposure Vulnerability in Hitachi Ops Center API Configuration Manager, Hitachi Configuration Manager.This issue affects Hitachi Ops Center API Configuration Manager: from 10.0.0-00 before 11.0.4-00; Hitachi Configuration Manager: from 8.6.1-00 before 11.0.5-00...

CVE-2026-27607 RustFS's Missing Post Policy Validation leads to Arbitrary Object Write

RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.56 through 1.0.0-alpha.82, RustFS does not validate policy conditions in presigned POST uploads PostObject, allowing attackers to bypass content-length-range, starts-with, and Content-Type constraints. This enabl...

CVE-2026-25521

Locutus (JavaScript stdlib for other languages) is affected by a prototype pollution vulnerability (CVE-2026-25521) in versions 2.0.12 through before 2.0.39. A crafted input can pollute Object.prototype via String.prototype usage, bypassing an earlier input check. The issue has been patched in 2....