LobsterAI 2026.5.27 through 2026.9.23 Arbitrary Directory Deletion via Skill _meta.json
CVE-2026-108156
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC h
#cwe-73
共收录 423 条相关情报。
← 返回所有主题An arbitrary file manipulation vulnerability exists in the WebTools management interface of...
CVE-2026-87685
An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions b
Docling has arbitrary file read/write (and command execution when shell-escape is enabled) when rendering untrusted TikZ with the opt-in Tectonic engine
CVE-2026-105744
### Summary When the LaTeX backend is configured to render TikZ pictures with the Tectonic engine (`LatexBackendOptions
Docling: Crafted DoclingDocument JSON embeds local image files into converted output
CVE-2026-105748
### Summary docling accepts serialized `DoclingDocument` JSON as an input format (`InputFormat.JSON_DOCLING`, enabled b
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper input validation in cloud storage...
CVE-2026-106494
Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/app-vite recursively removed the resolved build.distDir bef...
CVE-2026-106109
Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 1.0.0 until 3.3.0, @quasar/ap
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1, the icongenie generate --profile command accepted folder ...
CVE-2026-106103
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/icongenie 6.1.1,
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
CVE-2026-106219
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can update ...
CVE-2026-105865
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions befo
Nx: Path traversal in nx migrate package-migrations extraction
CVE-2026-104853
## Summary `nx migrate` reads each target package's `nx-migrations.migrations` value from its manifest and extracts the
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSON_DO...
CVE-2026-105748
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.94.0 until 2.132.0, callers that opt into L...
CVE-2026-105744
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecos
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed an authenticated Administrator to read...
CVE-2026-105676
Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme transla
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an attacker-controlled URL to `URLFetcher.fetch()`, which ca...
CVE-2026-86671
In Eclipse Che versions 7.29.0 and later, the GET `/api/scm/resolve` and `POST /api/factory/resolver` endpoints pass an
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The l...
CVE-2026-104809
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitra...
CVE-2026-104805
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can wri...
CVE-2026-103511
Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An att
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. An attacker holding the service authentication token can w...
CVE-2026-103507
Perforce P4 Search prior to 2026.4.2 does not restrict file paths written through its logging configuration interface. A
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration planning reads the nx-migrations.migrations value from a tar...
CVE-2026-104853
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration pla
Nx: Path traversal in nx migrate package-migrations extraction
CVE-2026-104853
Nx is a monorepo solution for TypeScript and polyglot codebases. From 13.10.0 until 22.7.10 and 23.2.1, Nx migration pla