goshs has a Path Traversal issue
CVE-2026-66063
## Summary The multipart upload filename fix splits on the path separator but never rejects dot-dot, allowing a write o
2026-07-29 归档
今日共收录 1422 条安全情报，包含 510 个 CVE，504 篇安全通告，以及 114 篇研究论文。
← 返回归档列表goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)
CVE-2026-54719
GHSA-wvhv-qcqf-f3cx fixed the per-folder .goshs ACL bypass on the state-changing routes (PUT/POST upload/?mkdir/?delete)
datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`
CVE-2026-55389
### Summary `datamodel-code-generator` resolves JSON-Schema `$ref` targets that point at the local filesystem without r
`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field
CVE-2026-54653
### Summary `datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-c
`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data
CVE-2026-54656
### Summary When the Pydantic v2 output mode is in use, `datamodel-code-generator` reads a `validators` array from each
datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements
CVE-2026-55415
#### Summary A malicious input schema (OpenAPI / JSON Schema) can execute arbitrary Python code on the machine that **i
`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description
CVE-2026-54621
### Summary `datamodel-code-generator` is vulnerable to code injection when generating Python models from an attacker-c
`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator
CVE-2026-54655
### Summary `datamodel-code-generator` honours a custom `x-python-type` JSON-Schema extension that lets a schema author
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance...
CVE-2026-6881
A SQL Injection in the Giving Reports functionality in Ellucian Advance Web and Legacy Advance allows an authenticated a
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is...
CVE-2026-15280
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is affected by a path-segm
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer...
CVE-2026-14893
IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.320 IBM Instana Node.js tracer component @instana/core
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0...
CVE-2026-14981
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 a
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0...
CVE-2026-15325
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 i
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0...
CVE-2026-15328
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 i
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0...
CVE-2026-15064
IBM WebSphere Application Server 9.0, and 8.5 and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 i
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of...
CVE-2026-15057
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.7 is vulnerable to a denial of service due to uncontr
SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows...
CVE-2026-57511
SuperPlane before 0.30.0 contains an SMTP header injection vulnerability that allows unauthenticated attackers to inject
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code...
CVE-2026-14976
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is affected by remote code execution with the colle
IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain...
CVE-2026-14528
IBM WebSphere Application Server 9.0, and 8.5 traditional could allow a remote attacker to obtain sensitive information.
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to...
CVE-2026-14515
IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scriptin