{
  "affected": [],
  "aliases": [
    "CVE-2025-65115"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-07T06:16:40Z",
    "severity": "HIGH"
  },
  "details": "Remote Code Execution Vulnerability\u00a0in JP1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management 2 - Operations Director on Windows, Job Management Partner 1/IT Desktop Management 2 - Manager on Windows, JP1/IT Desktop Management - Manager on Windows, Job Management Partner 1/IT Desktop Management - Manager on Windows, JP1/NETM/DM Manager on Windows, JP1/NETM/DM Client on Windows, Job Management Partner 1/Software Distribution Manager on Windows, Job Management Partner 1/Software Distribution Client on Windows.This issue affects JP1/IT Desktop Management 2 - Manager: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; JP1/IT Desktop Management 2 - Operations Director: from 13-50 before 13-50-02, from 13-11 before 13-11-04, from 13-10 before 13-10-07, from 13-01 before 13-01-07, from 13-00 before 13-00-05, from 12-60 before 12-60-12, from 10-50 through 12-50-11; Job Management Partner 1/IT Desktop Management 2 - Manager: from 10-50 through 10-50-11; JP1/IT Desktop Management - Manager: from 09-50 through 10-10-16; Job Management Partner 1/IT Desktop Management - Manager: from 09-50 through 10-10-16; JP1/NETM/DM Manager: from 09-00 through 10-20-02; JP1/NETM/DM Client: from 09-00 through 10-20-02; Job Management Partner 1/Software Distribution Manager: from 09-00 through 09-51-13; Job Management Partner 1/Software Distribution Client: from 09-00 through 09-51-13.",
  "id": "GHSA-h2gf-w3wm-8xqj",
  "modified": "2026-04-28T18:30:25Z",
  "published": "2026-04-07T06:30:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65115"
    },
    {
      "type": "WEB",
      "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2026-118/index.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-2150"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-03-03T18:15:10Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as critical, has been found in SourceCodester Insurance Management System 1.0. This issue affects some unknown processing. The manipulation of the argument page leads to file inclusion. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-255503.",
  "id": "GHSA-h3pc-p5gc-rxc4",
  "modified": "2024-03-03T18:30:47Z",
  "published": "2024-03-03T18:30:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2150"
    },
    {
      "type": "WEB",
      "url": "https://github.com/wkeyi0x1/vul-report/blob/main/Insurance%20Management%20System%20PHP%20and%20MySQL/Insurance%20Management%20System%20PHP%20and%20MySQL%20v1.0%20-%20File%20Inclusion.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.255503"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.255503"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.12.58"
      },
      "package": {
        "ecosystem": "npm",
        "name": "survey-pdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.12.59"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.5.4"
      },
      "package": {
        "ecosystem": "npm",
        "name": "survey-pdf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "2.5.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25630"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-35",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-04T20:07:34Z",
    "nvd_published_at": "2026-02-05T19:15:56Z",
    "severity": "CRITICAL"
  },
  "details": "The following security vulnerability was identified in jsPDF versions \u003c=3.0.4: [Local File Inclusion/Path Traversal](https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2).\n\n### Impact\n\nSince SurveyJS PDF Generator depends on jsPDF, any project using `survey-pdf` v1.12.58 and lower or v2.5.4 and lower could be exposed to this vulnerability.\n\n### Solution\n\nSurveyJS PDF Generator has upgraded jsPDF to version \u003e= 4.0.0 and included the fix in the following `survey-pdf` releases:\n\n* [v1.12.59](https://www.npmjs.com/package/survey-pdf/v/1.12.59)\n* [v2.5.5](https://www.npmjs.com/package/survey-pdf/v/2.5.5)\n\n### Action\n\nUsers should upgrade `survey-pdf` in their projects to v1.12.59+ or v2.5.5+ immediately.\n\n### Notes\n\nNo other `survey-pdf` dependencies are affected. This update is fully backward-compatible with previous `survey-pdf` releases.",
  "id": "GHSA-h3q6-jfrg-3x6q",
  "modified": "2026-02-05T21:47:25Z",
  "published": "2026-02-04T20:07:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/surveyjs/survey-pdf/security/advisories/GHSA-h3q6-jfrg-3x6q"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25630"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/surveyjs/survey-pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "survey-pdf Upgraded jsPDF Version Due to Security Vulnerability"
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 15.9.20"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Build.Tasks.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.8.166"
            },
            {
              "fixed": "15.9.30"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 16.11.0"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Build.Tasks.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.461"
            },
            {
              "fixed": "16.11.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 17.8.3"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Build.Tasks.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.0"
            },
            {
              "fixed": "17.8.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 17.10.4"
      },
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Build.Tasks.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.9.5"
            },
            {
              "fixed": "17.10.29"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Build.Tasks.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.11.4"
            },
            {
              "fixed": "17.12.36"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "17.11.4"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Build.Tasks.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.12.6"
            },
            {
              "fixed": "17.13.26"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "17.12.6"
      ]
    },
    {
      "package": {
        "ecosystem": "NuGet",
        "name": "Microsoft.Build.Tasks.Core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.13.9"
            },
            {
              "fixed": "17.14.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "17.13.9"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-26646"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-13T21:38:50Z",
    "nvd_published_at": "2025-05-13T22:15:20Z",
    "severity": "HIGH"
  },
  "details": "# Microsoft Security Advisory CVE-2025-26646: .NET Spoofing Vulnerability\n\n## \u003ca name=\"executive-summary\"\u003e\u003c/a\u003eExecutive summary\n\nMicrosoft is releasing this security advisory to provide information about a vulnerability in .NET 9.0.xxx and .NET 8.0.xxx SDK. This advisory also provides guidance on what developers can do to update their applications to address this vulnerability.\n\nA vulnerability exists in .NET SDK or MSBuild applications where external control of file name or path allows an unauthorized attacked to perform spoofing over a network.\n\n## Announcement\n\nAnnouncement for this issue can be found at https://github.com/dotnet/announcements/issues/356\n\n### \u003ca name=\"mitigation-factors\"\u003e\u003c/a\u003eMitigation factors\n\nProjects which do not utilize the [DownloadFile](https://learn.microsoft.com/visualstudio/msbuild/downloadfile-task)  build task are not susceptible to this vulnerability.\n\n## \u003ca name=\"affected-software\"\u003e\u003c/a\u003eAffected software\n\n* Any installation of .NET 9.0.105 SDK, .NET 9.0.203 SDK or earlier.\n* Any installation of .NET 8.0.115 SDK, .NET 8.0.311 or .NET 8.0.312 SDK, .NET 8.0.408 or .NET 8.0.409 SDK or earlier.\n\n## \u003ca name=\"affected-packages\"\u003e\u003c/a\u003eAffected Packages\nThe vulnerability affects any Microsoft .NET Core project if it uses any of affected packages versions listed below\n\nPackage name | Affected version | Patched version\n------------ | ---------------- | -------------------------\n[Microsoft.Build.Tasks.Core](https://www.nuget.org/packages/Microsoft.Build.Tasks.Core) |\u003e= 15.8.166, \u003c=15.9.20\u003cbr /\u003e\u003e=16.0.461, \u003c= 16.11.0\u003cbr /\u003e\u003e= 17.0.0, \u003c= 17.8.3\u003cbr/\u003e\u003e= 17.9.5, \u003c= 17.10.4\u003cbr /\u003e17.11.4\u003cbr /\u003e17.12.6 \u003cbr /\u003e17.13.9 | 15.9.30\u003cbr /\u003e16.11.6\u003cbr /\u003e17.8.29\u003cbr/\u003e17.10.29\u003cbr /\u003e17.12.36\u003cbr /\u003e17.13.26 \u003cbr /\u003e17.14.8\n\n## Advisory FAQ\n\n### \u003ca name=\"how-affected\"\u003e\u003c/a\u003eHow do I know if I am affected?\n\nIf you have a .NET SDK with a version listed, or an affected package listed in [affected software](#affected-packages) or [affected packages](#affected-software), you\u0027re exposed to the vulnerability.\n\n### \u003ca name=\"how-fix\"\u003e\u003c/a\u003eHow do I fix the issue?\n\n1. To fix the issue please install the latest version of .NET 9.0 SDK or .NET 8.0 SDK. If you have installed one or more .NET SDKs through Visual Studio, Visual Studio will prompt you to update Visual Studio, which will also update your .NET  SDKs.\n2. If your application references the vulnerable package, update the package reference to the patched version.\n\n* You can list the versions you have installed by running the `dotnet --info` command. You will see output like the following;\n\n```\n.NET SDK:\n Version:           9.0.100\n Commit:            59db016f11\n Workload version:  9.0.100-manifests.3068a692\n MSBuild version:   17.12.7+5b8665660\n\nRuntime Environment:\n OS Name:     Mac OS X\n OS Version:  15.2\n OS Platform: Darwin\n RID:         osx-arm64\n Base Path:   /usr/local/share/dotnet/sdk/9.0.100/\n\n.NET workloads installed:\nThere are no installed workloads to display.\nConfigured to use loose manifests when installing new manifests.\n\nHost:\n  Version:      9.0.0\n  Architecture: arm64\n  Commit:       9d5a6a9aa4\n\n.NET SDKs installed:\n  9.0.100 [/usr/local/share/dotnet/sdk]\n\n.NET runtimes installed:\n  Microsoft.AspNetCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]\n  Microsoft.NETCore.App 9.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]\n\nOther architectures found:\n  x64   [/usr/local/share/dotnet]\n    registered at [/etc/dotnet/install_location_x64]\n\nEnvironment variables:\n  Not set\n\nglobal.json file:\n  Not found\n\nLearn more:\n  https://aka.ms/dotnet/info\n\nDownload .NET:\n  https://aka.ms/dotnet/download\n```\n\n* If you\u0027re using .NET 9.0, you should download and install the appropriate SDK: `.NET 9.0.300` for Visual Studio 2022 v17.14, `.NET 9.0.204` for v17.13, or `.NET 9.0.106` for v17.12. Download from https://dotnet.microsoft.com/download/dotnet-core/9.0.\n\n* If you\u0027re using .NET 8.0, you should download and install the appropriate SDK: `.NET 8.0.410` for Visual Studio 2022 v17.11, `.NET 8.0.313` for v17.10, or `.NET 8.0.116` for v17.8. Download from https://dotnet.microsoft.com/download/dotnet-core/8.0.\n\nOnce you have installed the updated SDK, restart your apps for the update to take effect.\n\n## Other Information\n\n### Reporting Security Issues\n\nIf you have found a potential security issue in .NET 8.0 or .NET 9.0, please email details to secure@microsoft.com. Reports may qualify for the Microsoft .NET Core \u0026 .NET 5 Bounty. Details of the Microsoft .NET Bounty Program including terms and conditions are at \u003chttps://aka.ms/corebounty\u003e.\n\n### Support\n\nYou can ask questions about this issue on GitHub in the .NET GitHub organization. The main repos are located at https://github.com/dotnet/aspnetcore. The Announcements repo (https://github.com/dotnet/Announcements) will contain this bulletin as an issue and will include a link to a discussion issue. You can ask questions in the linked discussion issue.\n\n### Disclaimer\n\nThe information provided in this advisory is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
  "id": "GHSA-h4j7-5rxr-p4wc",
  "modified": "2025-06-16T13:54:46Z",
  "published": "2025-05-13T21:38:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/msbuild/security/advisories/GHSA-h4j7-5rxr-p4wc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26646"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/announcements/issues/356"
    },
    {
      "type": "WEB",
      "url": "https://github.com/dotnet/msbuild/issues/11846"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/dotnet/msbuild"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-26646"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Microsoft.Build.Tasks.Core .NET Spoofing Vulnerability"
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-0452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-20T10:15:52Z",
    "severity": "HIGH"
  },
  "details": "eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the \u0027/v1/agent/hub/update\u0027 endpoint. The application fails to properly filter the \u0027\\\u0027 character, which is commonly used as a separator in Windows paths. This vulnerability allows attackers to delete any files on the host system by manipulating the \u0027plugin_repo_name\u0027 variable.",
  "id": "GHSA-h4p8-798h-26f4",
  "modified": "2025-03-20T12:32:52Z",
  "published": "2025-03-20T12:32:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0452"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/7e854343-3d61-47d4-ad41-c4d2f356a54a"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-10559"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-02T02:16:15Z",
    "severity": "LOW"
  },
  "details": "A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is an unknown function of the file /index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be performed from remote. The exploit has been published and may be used.",
  "id": "GHSA-h4pm-23cv-46ch",
  "modified": "2026-06-02T03:31:25Z",
  "published": "2026-06-02T03:31:25Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10559"
    },
    {
      "type": "WEB",
      "url": "https://github.com/cyber-bhaskar10/CVE-Writeups/blob/main/CVE%20Writeup%20LFI%20via%20Null%20Byte%20Injection%20in%20index.php.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/cve/CVE-2026-10559"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/submit/828822"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/367649"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/vuln/367649/cti"
    },
    {
      "type": "WEB",
      "url": "https://www.sourcecodester.com"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-42732"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-610",
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-11-17T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability has been identified in syngo Dynamics (All versions \u003c VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website\u2019s application pool.",
  "id": "GHSA-h4pp-x3cc-f8mv",
  "modified": "2024-04-04T05:30:19Z",
  "published": "2023-07-06T19:24:04Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42732"
    },
    {
      "type": "WEB",
      "url": "https://www.siemens-healthineers.com/en-us/support-documentation/cybersecurity/shsa-741697"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-59185"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-10-14T17:15:56Z",
    "severity": "MODERATE"
  },
  "details": "External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.",
  "id": "GHSA-h5v9-h87r-rxhc",
  "modified": "2025-10-14T18:30:33Z",
  "published": "2025-10-14T18:30:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59185"
    },
    {
      "type": "WEB",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-59185"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.8.2"
      },
      "package": {
        "ecosystem": "crates.io",
        "name": "rattler_cache"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.23.2"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "py_rattler"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.24.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53956"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-09T23:20:12Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "`rattler_cache` and `py-rattler` were vulnerable to package-cache path traversal when handling package metadata from conda channels.\n\nDuring cache materialization, the `ratter_cache` code used the package record `build` string as part of a cache key that was joined into a filesystem path. A malicious or untrusted channel could publish repodata with path separators or traversal components in that field, causing package contents to be written outside the configured package cache directory.\n\nThe issue requires use of a malicious or otherwise untrusted conda channel. Curated channels that validate package metadata are not expected to allow malformed build strings of this form.\n\nUsers should upgrade to a patched version and avoid untrusted conda channels.",
  "id": "GHSA-h672-p7h7-97v9",
  "modified": "2026-07-09T23:20:12Z",
  "published": "2026-07-09T23:20:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/conda/rattler/security/advisories/GHSA-h672-p7h7-97v9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/conda/rattler"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Rattler vulnerable to package cache path traversal via conda package build string"
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.2.15"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-27008"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-73"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-18T22:44:18Z",
    "nvd_published_at": "2026-02-20T00:16:17Z",
    "severity": "MODERATE"
  },
  "details": "## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected versions: `\u003c= 2026.2.14`\n- Fixed in: planned release `2026.2.15`\n\n## Impact\nA bug in `download` skill installation allowed `targetDir` values from skill frontmatter to resolve outside the per-skill tools directory if not strictly validated.\nIn the admin-only `skills.install` flow, this could write files outside the intended install sandbox.\n\n## Fix Commit(s)\n- 2363e1b08 fix(security): restrict skill download target paths\n- b6305e972 test(skills): split installer security coverage\n\n## Acknowledgement\nThanks @Adam55A-code for reporting.",
  "id": "GHSA-h7f7-89mm-pqh6",
  "modified": "2026-02-20T16:47:32Z",
  "published": "2026-02-18T22:44:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-h7f7-89mm-pqh6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27008"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/2363e1b0853a028e47f90dcc1066e3e9809d65f1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/b6305e97256d67e439719faacf5af3de9727d6e1"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.2.15"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw hardened the skill download target directory validation"
}