Vulnerabilities in aehrc
6 resultsCVE-2026-47659HIGHPathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename}EPSS 0.6%CVE-2026-47661HIGHPathling has path traversal in $result endpoint that allows arbitrary warehouse file readEPSS 0.6%CVE-2026-47660HIGHPathling: Explicit oauthMetadataUrl in bulk-submit allows OAuth client credential exfiltrationEPSS 0.5%CVE-2026-47663HIGHPathling: Typed CRUD/search/batch providers can lead to server-wide PHI exfiltration and cross-resource mutationEPSS 0.4%CVE-2026-47662HIGHPathling $bulk-submit allows bearer-token exfiltration and persistent warehouse poisoning via unvalidated manifest output URLsEPSS 0.4%CVE-2026-47664HIGHPathling: $import-pnp operation enables authenticated SSRF, credential leakage, and warehouse data poisoningEPSS 0.2%