CVE-2026-7869

IBM Langflow OSS 1.0.0 through 1.10.3 is vulnerable to Path Traversal in the Knowledge Bases API POST /api/v1/knowledgebases. This occurs because user-supplied knowledge base names are used directly to create file paths without proper sanitization or containment checks. An authenticated attacker...

CVE-2026-70428

CVE-2026-70428 affects Jenkins versions 2.575 and earlier, and LTS 2.568.1 and earlier. A flaw in how file parameters identify paths allows path traversal, enabling attackers with Item/Configure and Item/Build permissions to write files to arbitrary locations on the controller file system. The im...

CVE-2026-70428

Jenkins 2.575 and earlier, LTS 2.568.1 and earlier improperly identifies file paths attempting path traversal in file parameter names, allowing attackers with Item/Configure and Item/Build permission to write files to arbitrary locations on the controller file system...

CVE-2026-7646

IBM Langflow OSS 1.0.0 through 1.10.3 allows users to read arbitrary files from the server filesystem, including other users' uploaded documents, the JWT signing secret, the SQLite database, and process environment variables, by sending a crafted MCP resources/read request with a URL-encoded path...

@codeanywhere/theia-plugin-ext (>=1.11.0, <=1.11.4), @devpodio/github-extension (1.0.0) +142 more potentially affected by CVE-2026-60009 via @theia/filesystem (>=1.0.0, <=1.73.1)

@theia/filesystem NPM version =1.0.0, =1.11.0, =0.1.7, =0.0.1-1585667205, =0.8.0-next.6917503, =0.0.1-next.20220331.125641, =0.0.5, =0.1.0-alpha.3ddb00f8, =0.2.0-next.25250370, =0.7.1, =0.9.1 - @pivotal-tools/theia-languageclient 0.0.5-alpha and more Source cves: CVE-2026-60009 Source advisory:...

CVE-2026-71269

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

CVE-2026-71269

CVE-2026-71269 affects Node-RED’s local-filesystem library storage module (getLibraryEntry() and saveLibraryEntry() in packages/node_modules/@node-red/runtime/lib/storage/localfilesystem/library.js). The vulnerability arises because GET/POST requests to /library/:lib/:type/*path join the user-sup...

CVE-2026-71269 Node-RED Library API Path Traversal Leading to Arbitrary File Read/Write

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

EUVD-2026-53354

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

CVE-2026-71269

Node-RED's local-filesystem library storage module getLibraryEntry and saveLibraryEntry in packages/nodemodules/@node-red/runtime/lib/storage/localfilesystem/library.js, reachable via GET/POST /library/:lib/:type/path, joins the user-supplied path parameter directly into the filesystem path via...

CVE-2026-60009

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

CVE-2026-61891

CVE-2026-61891 affects Eclipse Theia up to 1.73.1, specifically the @theia/filesystem backend. The HTTP endpoints GET /file, GET /files/, and PUT /files/ map a client-supplied URI directly to a filesystem path and stream the file, without confinement to the workspace or any allow-listed root. In ...

CVE-2026-61891

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend exposes HTTP file-download endpoints GET /file, GET /files/, PUT /files/ that convert a client-supplied URI directly to a filesystem path and stream the file, without confining it to the workspace or any...

CVE-2026-60009

In Eclipse Theia versions up to and including 1.73.1, the @theia/filesystem backend binds POST /file-upload in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart uri field and calls fs.movetmp, target, overwrite: true with no workspace...

MAL-2026-12138 Malicious code in agent-bot-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299eb5fe496022e888ed0663d0be82ddb8fac108bcb9a223291449982c360530 Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load, the client posts the...

Malicious code in agent-bot-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299eb5fe496022e888ed0663d0be82ddb8fac108bcb9a223291449982c360530 Package establishes a persistent remote-access channel to the hardcoded server https://server.junofficial.biz.id. On load, the client posts the...

CVE-2026-64567

In the Linux kernel, the following vulnerability has been resolved: btrfs: reject free space cache with more entries than pages When loading a v1 free space cache, loadfreespacecache takes numentries and numbitmaps straight from the on-disk btrfsfreespaceheader. That header is stored in the...

CVE-2026-47682

CVAT is an open source interactive video and image annotation tool for computer vision. In versions 1.6.0 through 2.64.0, an attacker with write access to a cloud storage that's been added to a CVAT instance, or ability to add new cloud storages, is able to overwrite arbitrary files on the server...

CVE-2026-47764

Summary of CVE-2026-47764 (pdm) : A path-traversal vulnerability in wheel installation arises from InstallDestination.write_to_fs() in src/pdm/installers/installers.py, where a safe validation helper (_path_with_destdir()) was replaced with a bare os.path.join(), removing path validation. Version...

CVE-2026-47764 pdm: Path traversal in wheel installation via overridden write_to_fs

pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs. InstallDestination.writetofs in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces t...