EUVD-2026-88665

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-96440

Flowring Agentflow 4.0 (versions prior to 2023/03/24) is vulnerable to a Path Traversal flaw in the /WebAgenda/download/uploadFile.jsp API endpoint. This vulnerability allows remote authenticated users to write files to arbitrary locations outside the intended upload directory by manipulating the...

CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）

Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...

CVE-2026-96431 Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file...

CVE-2026-96431 Flowring Agentflow 4.0 - Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file...

EUVD-2026-88662

Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to execute arbitrary system commands via a malicious file...

CVE-2026-96431

The Flowring Agentflow 4.0 software (versions before 2023/03/24 ) is vulnerable to an Unrestricted Upload of File with Dangerous Type via the /WebAgenda/download/uploadFile.jsp API endpoint. This flaw allows remote authenticated users with low privileges to execute arbitrary system commands by up...

EUVD-2026-88659

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...

CVE-2026-96430 Flowring Agentflow 4.0 - Exposed Dangerous Method or Function

Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote authenticated users to execute arbitrary SQL commands via the sql parameter...

CVE-2026-96430

Flowring Agentflow 4.0 (versions before 2026/08/28) contains an Exposed Dangerous Method or Function within the /WebAgenda/SQLWin.do API endpoint. This vulnerability allows remote authenticated users to execute arbitrary SQL commands via the sql parameter . The impact includes high severity conse...

CVE-2026-93282

A flaw was found in the Linux kernel's ksmbd server. This flaw allows an authenticated remote user to bypass access controls and gain unauthorized file access. When calculating maximal access permissions, ksmbd improperly combines rights from every Access Control Entry ACE regardless of whether t...

CVE-2026-98115

A flaw was found in the Linux kernel's ksmbd Server Message Block subsystem, which may lead to a Denial of Service DoS. When terminating multichannel SMB connections, the server fails to properly synchronize and wait for all communication channels to finish before freeing shared session resources...

CVE-2026-65093

A flaw was found in NVIDIA OpenShell. A remote authenticated attacker can exploit this vulnerability to escape the isolated sandbox environment. Successful exploitation can lead to arbitrary code execution, privilege escalation, and unauthorized access to data on the underlying host system...

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

EUVD-2026-87109

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

CVE-2026-93030

The FTM 4.x ALL software is vulnerable to an XML external entity injection flaw. This security weakness could allow a remote authenticated attacker to obtain sensitive information . No specific exploitation details or remediation steps are provided in the documents.

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

CVE-2026-93030

FTM 4.x ALL could allow a remote authenticated attacker to obtain sensitive information due to an XML external entity injection flaw...

CVE-2026-6087

The StockAgile platform by Novadigits technologies contains a Stored Cross-Site Scripting (XSS) vulnerability within its API and management panel . Specifically, the server-side REST endpoint /inventory/configuration/categories fails to properly filter or validate inputs in parameters such as 'co...