CVE-2026-11420

Two path traversal vulnerabilities in the Network Installation Service NIS of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to any writable location on the server filesystem and to read package archive files from the server. No authentication, session...

Evolver 路径遍历漏洞

Evolver is an intelligent agent-based self-evolution tool developed by EvoMap. Versions of Evolver prior to 1.69.3 contained a path traversal vulnerability. This vulnerability stemmed from issues with path traversal in skill download commands, which could allow attackers to write files to any...

EUVD-2026-21152

PraisonAIAgents has an OS Command Injection via shell=True in Memory Hooks Executor memory/hooks.py...

CVE-2026-40111

PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, he memory hooks executor in praisonaiagents passes a user-controlled command string directly to subprocess.run with shell=True at src/praisonai-agents/praisonaiagents/memory/hooks.py. No sanitization is performed and shell...

CVE-2026-40111

PraisonAIAgents memory/hooks.py allows OS command injection via a user-controlled string passed to subprocess.run() with shell=True before 1.5.128. No sanitization occurs, shell metacharacters are interpreted by /bin/sh, enabling execution of arbitrary commands. Two attack surfaces exist: pre_run...

PT-2026-29498

Summary @tinacms/cli recently added lexical path-traversal checks to the dev media routes, but the implementation still validates only the path string and does not resolve symlink or junction targets. If a link already exists under the media root, Tina accepts a path like...

PT-2026-20972

Name of the Vulnerable Software and Affected Versions Music Assistant versions 2.6.3 and below Description Music Assistant is an open-source media library manager that integrates streaming services with connected speakers. Versions 2.6.3 and below allow unauthenticated network-adjacent attackers ...

CVE-2017-18446

cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API SEC-250...

Self-hosted n8n has Legacy Code node that enables arbitrary file read/write

Impact In self-hosted n8n instances where the Code node runs in legacy non-task-runner JavaScript execution mode, authenticated users with workflow editing access can invoke internal helper functions from within the Code node. This allows a workflow editor to perform actions on the n8n host with...

EUVD-2012-6161

Malware in sbrugna...

EUVD-2020-20077

Malware in sbrugna...

EUVD-2021-13995

Malware in sbrugna...

EUVD-2018-0108

Malware in sbrugna...

EUVD-2018-13420

Malware in sbrugna...

EUVD-2015-4525

Malware in sbrugna...

EUVD-2014-2317

Malware in sbrugna...

EUVD-2015-7604

Malware in sbrugna...

EUVD-2015-8210

Malware in sbrugna...

EUVD-2016-5386

Malware in sbrugna...

EUVD-2025-4918

Malicious code in bioql PyPI...