CVE-2026-55747 PocketFlow - Path Traversal in pocketflow-coding-agent Cookbook Example File Tools

The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.joinworkdir, p wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this...

CVE-2026-61443

PraisonAI prior to 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_script() due to lack of path containment validation. This allows attackers to supply absolute file paths and execute arbitrary scripts from any filesystem location, including outside the intended work...

CVE-2026-39245

decompress before 4.2.2 contains an improper path containment check that enables directory traversal and arbitrary file write. The safeMakeDir function index.js line 29 and the extraction path validation index.js line 106 use String.indexOf to verify the resolved path is within the output...

FreeBSD : FreeBSD -- unlinkat(2) ignores AT_RESOLVE_BENEATH flag (33fd66d1-74e2-11f1-958d-bc241121aa0a)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 33fd66d1-74e2-11f1-958d-bc241121aa0a advisory. The kernel function that implements unlinkat2 and funlinkat2 validated the ATRESOLVEBENEATH flag but...

DEBIAN-CVE-2026-44837

viewcomponent is a framework for building reusable, testable, and encapsulated view components in Ruby on Rails. From 3.0.0 to 4.9.0, the system test entrypoint canonicalizes a user-controlled file path with File.realpath, then checks whether the resolved path starts with the temp directory path...

CVE-2025-62002

BullWall Ransomware Containment has a file-modification-based detection mechanism that can be bypassed. An authenticated attacker could encrypt a single large file without triggering alerts when thresholds are configured to require multiple file changes. Affected versions include 4.6.0.0, 4.6.0.6...

XunRuiCMS 安全漏洞

XunRuiCloud Software Development XunRuiCMS XunRui CMS is an open source content management system CMS from China XunRuiCloud Software Development Company. XunRuiCMS v4.3.3 to v4.5.1 version of a security vulnerability, the vulnerability stems from the existence of PHP file write and file...

Document Containment Vulnerability in e-Government Platform of Shanghai Jofan Information Technology Co.

The eGovernment platform is an office system. A file inclusion vulnerability exists in the e-government platform of Shanghai Zhuo Fan Information Technology Co., Ltd, which allows attackers to obtain sensitive information such as configuration files by guessing the file directory...