202 matches found
CVE-2026-25525
Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter...
CVE-2026-25525 OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module
Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter...
CVE-2026-25525
Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter...
CVE-2026-25525
OpenMage LTS (Magento Long Term Support) Dataflow module before 20.17.0 is affected by a path traversal filter bypass. The weak blacklist uses str_replace('../', '', $input), which can be bypassed with patterns like ..././ or ....//, still resulting in ../ after replacement. An authenticated admi...
PT-2026-33797
The Dataflow module in OpenMage LTS uses a weak blacklist filter str replace'../', '', $input to prevent path traversal attacks. This filter can be bypassed using patterns like ..././ or ....//, which after the replacement still result in ../. An authenticated administrator can exploit this to re...
CVE-2026-25525: Improper Limitation of a Pathname to a Restricted Directory
Magento Long Term Support LTS is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a high level of backward compatibility. Prior to version 20.17.0, the Dataflow module in OpenMage LTS uses a weak blacklist filter...
OpenMage Magento Lts (Magento) security vulnerabilities
OpenMage Magento Lts Magento is an e-commerce system developed by the OpenMage organization. Versions of OpenMage Magento Lts prior to 20.17.0 contained security vulnerabilities. These vulnerabilities stemmed from the Dataflow module’s use of a weak blacklist filter to prevent path traversal...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-30912 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-30912 Source advisory: OSV:PYSEC-2026-18...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-25917 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-25917 Source advisory: OSV:PYSEC-2026-13...
dataflow-airflow (2.10.3) potentially affected by CVE-2025-54550 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2025-54550 Source advisory: OSV:GHSA-Q2HG-643C-GW8H...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-25219 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-25219 Source advisory: OSV:GHSA-4G48-54Q2-FG7Q...
dataflow-421 (>=0.1.8, <=0.2.12), easyroutine (>=1.1.1, <=1.1.5) +2 more potentially affected by CVE-2026-1839 via transformers (4.51.1)
transformers PYPI version 4.51.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - dataflow-421 =0.1.8, =1.1.1, =1.0.10, =1.18.0, =1.27.0 Source cves: CVE-2026-1839 Source advisory: OSV:GHSA-69W3-R845-3855...
Agent Audit: A Security Analysis System for LLM Agent Applications
What should a developer inspect before deploying an LLM agent: the model, the tool code, the deployment configuration, or all three? In practice, many security failures in agent systems arise not from model weights alone, but from the surrounding software stack: tool functions that pass untrusted...
ChainFuzzer: Greybox Fuzzing for Workflow-Level Multi-Tool Vulnerabilities in LLM Agents
Tool-augmented LLM agents increasingly rely on multi-step, multi-tool workflows to complete real tasks. This design expands the attack surface, because data produced by one tool can be persisted and later reused as input to another tool, enabling exploitable source-to-sink dataflows that only...
dataflow-airflow (2.10.3) potentially affected by CVE-2026-24098 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2026-24098 Source advisory: OSV:GHSA-5G2W-9F8G-G5Q7...
dataflow-airflow (2.10.10) potentially affected by CVE-2025-68675 via apache-airflow-providers-microsoft-azure (12.8.1)
apache-airflow-providers-microsoft-azure PYPI version 12.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-microsoft-azure and may be impacted: - dataflow-airflow 2.10.10 Source cves: CVE-2025-68675 Source advisory:...
dataflow-airflow (2.10.3) potentially affected by CVE-2025-68675 via apache-airflow (2.10.3)
apache-airflow PYPI version 2.10.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - dataflow-airflow 2.10.3 Source cves: CVE-2025-68675 Source advisory: OSV:PYSEC-2026-10...
EUVD-2025-36119
Malicious code in dataflow-unified npm...
MAL-2025-48783 Malicious code in dataflow-unified (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eeb92e0d113a35c9340e56c29e540f04d548f6e42f05f369d8e22fb5d78dea39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview dataflow-unified is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...