CVE-2026-60093 Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

CVE-2026-60093

The camel-azure-storage-datalake component in Apache Camel (4.0.0 before 4.14.9, 4.15.0 before 4.18.4, 4.19.0 before 4.22.0) contains a relative path traversal (CWE-22) in its downloadToFile operation. The local target path is built by joining fileDir with the remote file name verbatim, with no c...

EUVD-2026-64954

Relative path traversal vulnerability in Apache Camel Azure-Storage Datalake component This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-datalake component can download an Azure Data Lake Storage Gen2 file to t...

CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

EUVD-2026-64952

rConfig before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal sequences t...

CVE-2026-77914 rConfig Core 8.0.0 < 8.2.13 Core Path Traversal via Export Download Endpoint

rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames containing directory traversal sequences to the export download endpoint. Attackers can manipulate the filename parameter with traversal...

CVE-2026-77914

rConfig versions prior to 8.2.13 contain a path traversal vulnerability in the export download endpoint . An authenticated attacker can manipulate the filename parameter with directory traversal sequences to escape the intended export directory and read arbitrary files accessible to the applicati...

CVE-2026-71364

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364

A path traversal vulnerability in AWX 's project_archive action plugin (part of Red Hat Ansible Automation Platform ) allows arbitrary file writes on the execution node. The plugin extracts zip/tar members by joining the project directory path with the member filename without path normalization o...

EUVD-2026-64918

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

CVE-2026-71364 Awx: project archive extraction allows path traversal file writes

A path traversal vulnerability was found in AWX's project archive extraction. The projectarchive action plugin extracts zip and tar archive members by joining the project directory path with the member filename without performing path normalization, boundary validation, or rejecting directory...

Security Bulletin: Langflow is affected by multiple authentication bypass, path traversal, authorization, and server-side request forgery vulnerabilities

Summary Langflow contains multiple vulnerabilities in its authentication, authorization, and network request controls across several API surfaces. The MCP project authentication function omits the default authtype=none value from the set of modes requiring an API key, causing unauthenticated...

Security Bulletin: Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement

Summary Langflow OSS supports custom Python components and validation of component code for component development workflows. Weaknesses in custom component execution paths, validation endpoints, and trusted template enforcement could allow authenticated users to execute arbitrary Python code or...

Important: Red Hat Security Advisory: python3.12 security update

An update for python3.12 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2026-78381

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that...

CVE-2026-76842

The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL survive into the outgoing request. The payment get, capture, cancel, paymentRefund create, total, list, get, advancedPayment get,...

CVE-2026-78381 RansomLook Arbitrary File Read via Path Traversal in Post screen Field

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that...

EUVD-2026-64859

RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts. The GroupPost.get API handler concatenates the database-controlled screen value directly with the application's source/ directory and opens the resulting path without verifying that...

CVE-2026-78381

RansomLook is vulnerable to arbitrary file read via a path traversal flaw in the screen field of group posts. The GroupPost.get API handler concatenates the database-stored screen value directly with the application's source/ directory without verifying the resolved path stays within that directo...

Important: Red Hat Security Advisory: python3.14 security update

An update for python3.14 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...