CVE-2026-100536 OpenClaw before 2026.8.1 Path Traversal via Structured Attachments

OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypass sandbox path validation and cause...

CVE-2026-100536 OpenClaw before 2026.8.1 Path Traversal via Structured Attachments

OpenClaw versions before 2026.8.1 fail to validate all source fields in structured message attachments, allowing attackers to hide unvalidated host paths behind allowed attachment sources. Attackers can exploit this by providing multiple source fields to bypass sandbox path validation and cause...

PT-2026-99173

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.8.1 Description Insufficient validation of source fields in structured message attachments allows attackers to bypass sandbox path validation. By providing multiple source fields, an attacker can hide unvalidate...

Apache cxf-core: No restriction on attachment headers per message

There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2 or 4.1.7 or 3.6.12, which fix this...

Open WebUI 路径遍历漏洞

Open WebUI is an extensible, feature-rich, and user-friendly self-hosted WebUI that is open source. Versions of Open WebUI prior to 0.1.124 contained a path traversal vulnerability. This vulnerability occurred when files were attached in messages, where the file names originated from the original...

CVE-2025-64712

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to version 0.18.18, a path traversal vulnerability in the partitionmsg function allows an attacker to write or overwrite arbitra...

CVE-2025-64712

CVE-2025-64712 affects the Unstructured library. Prior to version 0.18.18, a path traversal flaw in the partition_msg function enables writing or overwriting arbitrary files when processing malicious MSG attachments. The issue has been patched in version 0.18.18. Affected scope and impact are des...

EUVD-2025-206785

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to version 0.18.18, a path traversal vulnerability in the partitionmsg function allows an attacker to write or overwrite arbitra...

CVE-2020-37090

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server...

CVE-2020-37090

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server...

CVE-2020-37090 School ERP Pro 1.0 - Remote Code Execution

School ERP Pro 1.0 contains a file upload vulnerability that allows students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts through the message attachment feature, enabling remote code execution on the server...

CVE-2020-37090

CVE-2020-37090 affects School ERP Pro 1.0. The vulnerability resides in the message-attachment file upload, which can be exploited to upload arbitrary PHP files, enabling remote code execution on the server. Root cause evidenced in the connected PT-2026-5840 entry: inadequate validation/verificat...

Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write

A Path Traversal vulnerability in the partitionmsg function allows an attacker to write or overwrite arbitrary files on the filesystem when processing malicious MSG files with attachments. Impact An attacker can craft a malicious .msg file with attachment filenames containing path traversal...

PT-2026-5840

Name of the Vulnerable Software and Affected Versions School ERP Pro version 1.0 Description School ERP Pro 1.0 has a file upload issue that permits students to upload arbitrary PHP files to the messaging system. Attackers can upload malicious PHP scripts via the message attachment feature, leadi...

PT-2026-5943

Name of the Vulnerable Software and Affected Versions Unstructured versions prior to 0.18.18 Description The Unstructured library, used for ingesting and pre-processing various document types like PDFs, HTML, Word documents, and images, contains a path traversal vulnerability in the partition msg...

EUVD-2016-2883

Malware in sbrugna...

EUVD-2019-0728

Malware in sbrugna...

EUVD-2022-3066

Malicious code in bioql PyPI...

EUVD-2023-2285

Malicious code in bioql PyPI...

Security Bulletin: IBM Security Guardium is affected by multiple vulnerabilities

Summary IBM Security Guardium has fixed these vulnerabilities. Vulnerability Details CVEID:CVE-2021-39077 DESCRIPTION: IBM Security Guardium stores user credentials in plain clear text which can be read by a local privileged user. CVSS Base score: 4.4 CVSS Temporal Score: See:...