CVE-2026-26187: Improper Limitation of a Pathname to a Restricted Directory

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to 1.77.0, the local block adapter pkg/block/local/adapter.go allows authenticated users to read and write files outside their designated storage boundaries. The verifyRelPath function used...

SQL Injection

github.com/casdoor/casdoor is vulnerable to sql injection. An attacker can inject and execute malicious input through the GetSession function of adapter.go as it does not properly filter the user input field and value parameters...