2026

DB-GPT v0.7.5 and v0.8.0 contains directory traversal in python_file_upload (packages/dbgpt-app/src/dbgpt_app/openapi/ap

DB-GPT 0.8.0 contains directory traversal in skill_upload (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Code Injection in src/backend/bisheng/api/v1/validate.py.

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to Directory Traversal in src/backend/bisheng/linsight/domain/task_e

bisheng 2.3.0, 2.4.0, and 2.4.0-beta1 is vulnerable to directory traversal in save_download_file (src/backend/bisheng/co

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execu

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through Sub

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes execute_python_code as an available tool

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.__

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.sa

modelscope Agentscope v1.0.0-v1.0.8 is vulnerable to Path Traversal in insert_text_file.

modelscope Agentscope v1.0.18-v1.0.0 is vulnerable to Path Traversal in write_text_file.

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alph

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files c

pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1

pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source

A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker c

Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an unauthenticated attacker to store crafted

An authenticated Email Protection Gateway administrator holding only limited, delegated permissions could write files wi

An authenticated administrator could cause the server to issue requests to, and interact with, internal network services

A resource exhaustion vulnerability in Kiteworks Email Protection Gateway allowed an unauthenticated remote attacker to

An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesyste

A system notification template on the Kiteworks appliance was rendered by a template engine that evaluated expressions c

Two Kiteworks Core cluster-management operations did not validate file paths supplied to them, so an attacker holding ro

An authenticated administrator could initiate an administrative import using a file whose contents were not fully verifi

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establ

An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a conne

An authenticated administrator could bypass the content validation applied to an administrative file upload and store a

In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a valu

On a Kiteworks Email Protection Gateway cluster with database replication enabled, a party trusted by the cluster could

Kiteworks Core did not apply its gateway-level API security controls to every request authenticated through the platform

An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to cre

Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every f

Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an admin

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant t

An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks plat

An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional,

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narro

The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it.

A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configurat

A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could a

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configur

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms c

A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution

A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to m

A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a lo