29248 matches found
CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...
CVE-2026-96431
The Flowring Agentflow 4.0 software (versions before 2023/03/24 ) is vulnerable to an Unrestricted Upload of File with Dangerous Type via the /WebAgenda/download/uploadFile.jsp API endpoint. This flaw allows remote authenticated users with low privileges to execute arbitrary system commands by up...
EUVD-2026-88662
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file...
CVE-2026-96431 Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file...
CVE-2026-96431 Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file...
CVE-2026-96430 Flowring Agentflow 4.0 - Exposed Dangerous Method or Function
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...
CVE-2026-96430
Flowring Agentflow 4.0 (versions before 2026/08/28) contains an Exposed Dangerous Method or Function within the /WebAgenda/SQLWin.do API endpoint. This vulnerability allows remote authenticated users to execute arbitrary SQL commands via the sql parameter . The impact includes high severity conse...
EUVD-2026-88659
Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...
PT-2026-102798
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation of paths during archive extraction...
CVE-2026-96440: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...
CVE-2026-102242: Improper Link Resolution Before File Access
Improper link resolution CWE-59 / CWE-22 in the allowedLocalRoots path validation in Google MCP Toolbox for Databases versions 1.2.0 through 1.9.0 allows a remote authenticated attacker with tool execution permissions to bypass directory boundary restrictions via symbolic links. Because path...
PT-2026-102467
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...
PT-2026-102466
Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file...
CVE-2026-93282
A flaw was found in the Linux kernel's ksmbd server. This flaw allows an authenticated remote user to bypass access controls and gain unauthorized file access. When calculating maximal access permissions, ksmbd improperly combines rights from every Access Control Entry ACE regardless of whether t...
CVE-2026-98115
A flaw was found in the Linux kernel's ksmbd Server Message Block subsystem, which may lead to a Denial of Service DoS. When terminating multichannel SMB connections, the server fails to properly synchronize and wait for all communication channels to finish before freeing shared session resources...
Security Bulletin: IBM Optim Test Data Management 1.0.0, 1.1.0, and 1.2.0 impacted by Path Traversal, Rate Limiting, and Weak Password Policy vulnerabilities (CWE-22)
Summary IBM Optim Test Data Management versions 1.0.0, 1.1.0, and 1.2.0 are affected by three medium-severity vulnerabilities including File Path Traversal, Abuse of Functionality with No Rate Limiting, and Weak Password Policy. IBM Optim Test Data Management 2.0.0 resolves these vulnerabilities ...
CVE-2026-65093
A flaw was found in NVIDIA OpenShell. A remote authenticated attacker can exploit this vulnerability to escape the isolated sandbox environment. Successful exploitation can lead to arbitrary code execution, privilege escalation, and unauthorized access to data on the underlying host system...
CVE-2026-93030
FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...
CVE-2026-93030
The FTM 4.x ALL software is vulnerable to an XML external entity injection flaw. This security weakness could allow a remote authenticated attacker to obtain sensitive information . No specific exploitation details or remediation steps are provided in the documents.