CVE-2026-7869

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

EUVD-2026-53550

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker...

CVE-2026-7869

CVE-2026-7869 : IBM Langflow OSS (versions 1.0.0 through 1.10.3) is affected by a path traversal in the Knowledge Bases API via POST /api/v1/knowledge_bases. User-supplied knowledge base names are used directly to create file paths without proper sanitization, allowing an authenticated attacker t...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

CVE-2026-70427

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of .tar and .tar.gz archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary...

Malicious code in bigops-insite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbe91d01b6f87752714ea87b8c79ecdda9497faf4a99709118330640cfaf46a2 On require'bigops-insite', index.js top-level loads./setup.js, which downloads a platform-specific binary from hardcoded Cloudflare Workers subdomain...

Malicious code in bigops-products-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 265e87afdb04434bf53739963fd1c91ddb80c8ac957384377898c0aaf87cf826 On require'bigops-products-mobile', index.js loads loader.js which selects a platform-specific binary path, fetches attacker-controlled bytes over...

Malicious code in dlp-dlp-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a7f83a18ee0f4d41331997bd85740febbb8d8e581fa9026b83112e55d2b8320 On require'dlp-dlp-core', index.js loads setup.js which selects a platform-specific path /pkg/package, /pkg/package-arm64, /pkg/loadermac,...

MAL-2026-13286 Malicious code in dolyame-boxy-atom-bnpl-dolyame-button (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c249dddf9e2ab4659fe99f1945e7b6dd832178da7b207fa86923d8c23ae60143 On require, adapter.js selects a platform-specific endpoint, fetches an opaque binary over HTTPS from one of several Cloudflare Workers mirrors...

MAL-2026-13284 Malicious code in dolyame-boxy-atom-bnpl-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7992916c62a9926f06f313367b6b684674413ecac4fe8cf1e0130165ae651fc7 On require of the package, index.js loads adapter.js, which downloads a platform-specific native binary from hardcoded destinations assembled via...

MAL-2026-13287 Malicious code in dolyame-boxy-atom-bnpl-image-card (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 484dee0934d765de93fad820114619db6ba613ac0eae09b9b402949f116e796f The package's main entry loads setup.js, which on require fetches a platform-specific binary from Cloudflare Workers subdomains whose hostnames are...

MAL-2026-13294 Malicious code in dolyame-boxy-atom-desktop-bnpl-dangerously-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2 On require of the package, index.js unconditionally loads polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains...

MAL-2026-13298 Malicious code in dolyame-boxy-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919c54c4e8e0b08b62f76b85369a9033929f8ea19dfc777b8ece48697229a5ce [email protected] ships a runtime.js module that is unconditionally required from index.js at load time. On import, runtime.js reconstructs...

Malicious code in dolyame-boxy-independent-bnpl-table (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...

Malicious code in dolyame-boxy-independent-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d558b476b362ab912d18912a13c79e326b5fcdcdbe73b0f292d94aa89ac732d On require of the package, index.js loads runtime.js, which assembles Cloudflare Workers hostnames oob-worker.cf102-baf.workers.dev,...

Malicious code in dolyame-ui-breadcrumbs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7679dd0e86411f0df5eea8392ad6f6a663ab0d911cd674b3ef4605af846cb323 On require of dolyame-ui-breadcrumbs, index.js loads bridge.js which reconstructs C2 hostnames at runtime via string-splitting/array-join resolving t...

Malicious code in dolyame-boxy-mobile-bnpl-text-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e5ba9319e9ab791d3944f19baaae57aac3c2d381bf03ccf736d8ae09a2ba4b6 On any require of the package, index.js loads./compat.js, which fetches a native binary from string-fragmented Cloudflare Workers hosts under...