WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-22✕
Overview 4,247 matches · 189 in Waratek scope · 181 protected · 69 exploited · 12 CISA KEV · 902 public PoC · 52 EPSS ≥ 0.5
4,247matches 189in Waratek scope4.5% 181protected4.3% 69exploited1.6% 12CISA KEV0.3% 902public PoC21.2% 52EPSS ≥ 0.51.2%
Protected by Waratek 181 4.3% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 8 0.2% Outside Waratek scope 55 1.3% Not applicable 4,003 94.3% Withdrawn CVE 0 0.0%
Critical 0 0.0% High 0 0.0% Medium 4,247 100.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 181 4.3% partly blocked 0 0.0% not blocked 4,066 95.7% not established 0 0.0% unrecorded 0 0.0%
Exploited 69 1.6% Working exploit published 850 20.0% Proof of concept only 605 14.2% Forecast only 7 0.2% No public exploit 2,716 64.0%
split by peak 1,082 / year
Not applicable: 4,003Outside Waratek scope: 55No exploit published: 8Protected by Waratek: 181 Medium: 4,247 not blocked: 4,066blocked by ARMR today: 181 No public exploit: 2,716Forecast only: 7Proof of concept only: 605Working exploit published: 850Exploited: 69
20014 Not applicable4 Medium4 not blocked4 Working exploit published3 No public exploit1 200213 Protected by Waratek1 Not applicable12 Medium13 blocked by ARMR today1 not blocked12 Working exploit published5 No public exploit8 200317 Protected by Waratek1 Not applicable16 Medium17 blocked by ARMR today1 not blocked16 Working exploit published6 No public exploit11 20048 Not applicable8 Medium8 not blocked8 Working exploit published4 No public exploit4 200510 Not applicable10 Medium10 not blocked10 Working exploit published4 No public exploit6 200619 Protected by Waratek2 Not applicable17 Medium19 blocked by ARMR today2 not blocked17 Working exploit published8 No public exploit11 200793 Outside Waratek scope1 Not applicable92 Medium93 not blocked93 Working exploit published71 No public exploit22 2008216 Protected by Waratek4 Not applicable212 Medium216 blocked by ARMR today4 not blocked212 Exploited1 Working exploit published180 No public exploit35 2009196 Protected by Waratek4 Not applicable192 Medium196 blocked by ARMR today4 not blocked192 Exploited2 Working exploit published165 No public exploit29 2010179 Protected by Waratek3 Not applicable176 Medium179 blocked by ARMR today3 not blocked176 Exploited2 Working exploit published123 No public exploit54 201178 Protected by Waratek1 Outside Waratek scope1 Not applicable76 Medium78 blocked by ARMR today1 not blocked77 Exploited1 Working exploit published39 No public exploit38 201288 Protected by Waratek1 Not applicable87 Medium88 blocked by ARMR today1 not blocked87 Exploited2 Working exploit published41 No public exploit45 201364 Protected by Waratek4 Outside Waratek scope5 Not applicable55 Medium64 blocked by ARMR today4 not blocked60 Exploited3 Working exploit published19 No public exploit42 2014151 Protected by Waratek5 Outside Waratek scope4 Not applicable142 Medium151 blocked by ARMR today5 not blocked146 Exploited5 Working exploit published52 Proof of concept only1 No public exploit93 201590 Protected by Waratek6 Outside Waratek scope1 Not applicable83 Medium90 blocked by ARMR today6 not blocked84 Exploited8 Working exploit published28 No public exploit54 201635 Protected by Waratek3 Outside Waratek scope1 Not applicable31 Medium35 blocked by ARMR today3 not blocked32 Exploited2 Working exploit published2 No public exploit31 201785 Protected by Waratek3 Outside Waratek scope3 Not applicable79 Medium85 blocked by ARMR today3 not blocked82 Exploited2 Working exploit published12 Proof of concept only1 No public exploit70 2018163 Protected by Waratek20 Not applicable143 Medium163 blocked by ARMR today20 not blocked143 Exploited4 Working exploit published17 No public exploit142 2019161 Protected by Waratek13 Outside Waratek scope3 Not applicable145 Medium161 blocked by ARMR today13 not blocked148 Exploited4 Working exploit published18 No public exploit139 2020140 Protected by Waratek11 Outside Waratek scope3 Not applicable126 Medium140 blocked by ARMR today11 not blocked129 Exploited6 Working exploit published13 Forecast only1 No public exploit120 2021184 Protected by Waratek6 Outside Waratek scope8 Not applicable170 Medium184 blocked by ARMR today6 not blocked178 Exploited3 Working exploit published8 Forecast only1 No public exploit172 2022216 Protected by Waratek27 Outside Waratek scope4 Not applicable185 Medium216 blocked by ARMR today27 not blocked189 Exploited3 Working exploit published9 Proof of concept only15 No public exploit189 2023223 Protected by Waratek11 Outside Waratek scope8 Not applicable204 Medium223 blocked by ARMR today11 not blocked212 Exploited3 Working exploit published5 Proof of concept only49 Forecast only3 No public exploit163 2024323 Protected by Waratek7 No exploit published4 Outside Waratek scope3 Not applicable309 Medium323 blocked by ARMR today7 not blocked316 Exploited5 Working exploit published6 Proof of concept only81 Forecast only1 No public exploit230 2025409 Protected by Waratek12 No exploit published1 Outside Waratek scope3 Not applicable393 Medium409 blocked by ARMR today12 not blocked397 Exploited4 Working exploit published6 Proof of concept only133 Forecast only1 No public exploit265 20261,082 Protected by Waratek36 No exploit published3 Outside Waratek scope7 Not applicable1,036 Medium1,082 blocked by ARMR today36 not blocked1,046 Exploited9 Working exploit published6 Proof of concept only325 No public exploit742
200220052008201120142017202020232026
4,247 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 1 of 43 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2026-129121 Medium 2026-11-13 Not applicable No public exploit C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution.
CVE-2026-128328 Medium 2026-11-13 Not applicable Proof of concept only Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to list tracked files of any git repository by supplying an arbitrary repoPath to patch.readRepoDirectories. Attackers with read access to one service can enumerate file and directory names of other tenants' application and compose source trees on the host or managed servers.
CVE-2026-128079 Medium 2026-11-13 Not applicable No public exploit envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 and before 1.3.6, insufficient containment of host-side requirements-file reads in  install.python_packages(requirements=...)  could allow access to files outside the build context. An attacker able to influence build input could cause file contents interpreted as dependency entries to appear in debug logs or build-step metadata, subject to the envd process’s permissions. Exploitation in version 1.3.5 additionally requires concurrent modification of relevant filesystem paths. This issue is fixed in version 1.3.6.
CVE-2026-127074 Medium 2026-11-13 Not applicable No public exploit OpsTree BuildPiper before 2.7.0 contains a path traversal vulnerability that allows authenticated users with build configuration permission to read files on the build worker by supplying unvalidated dockerfile_path and build context values. Attackers can set traversal or absolute paths such as /etc/passwd via the CI configuration endpoint, then trigger a build to disclose file contents in the build log.
CVE-2026-126951 Medium 2026-11-13 Not applicable No public exploit Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server files by abusing a fallback treating the :id parameter as a datasource key. Attackers can send encoded traversal sequences in the :id of GET /api/user/files/:id/raw to escape the Local datasource uploads directory and read files like /etc/shadow.
CVE-2026-126944 Medium 2026-11-13 Not applicable No public exploit Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or delete files outside the upload directory by importing records with traversal filenames. Attackers can trigger the unchecked range-read path with byte-range requests or set expired deletion times to delete files accessible to the Zipline process.
CVE-2026-126364 Medium 2026-11-13 Not applicable No public exploit Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /_image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory only by letter case could therefore pass the containment check, allowing an unauthenticated requester to read image files accepted by the image service from outside the output directory. Exploitation required on-demand rendering with the @astrojs/node adapter, a case-sensitive filesystem, and a preexisting case-variant sibling directory; ordinary traversal to unrelated paths was already rejected. This issue is fixed in Astro version 7.4.7.
CVE-2026-74850 Medium 2026-11-12 Not applicable No public exploit An improper limitation of a pathname to a restricted directory vulnerability in the contentextract in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users to read specific files.
CVE-2026-127209 Medium 2026-11-12 Not applicable Proof of concept only Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.
CVE-2026-127202 Medium 2026-11-12 Not applicable No public exploit MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated remote attackers to write files outside the intended run directory by supplying a malicious model_id parameter to the log outputs API. Attackers can exploit the unvalidated model_id containing ../ sequences via the POST /api/3.0/mlflow/runs/outputs endpoint to create directories and write a meta.yaml file at arbitrary filesystem locations, limited only by the server account's permissions. FileStore was the default backend before 3.7.0 and is opt-in afterward through MLFLOW_ALLOW_FILE_STORE.
CVE-2026-126354 Medium 2026-11-12 Not applicable No public exploit Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. From 2.2.5 until 2.9.1, Addressable::URI.normalize_path can resolve a path containing leading parent segments and later parent segments to a different path than an RFC 3986 resolver. URI#normalize, URI#join, URI#==, and URI#=== inherit the result. An application that authorizes the Addressable-normalized path but sends the original URI to another resolver can allow access outside the intended path allowlist. Applications that use the same normalized value for authorization and the request, or reject parent segments, are unaffected. This issue is fixed in version 2.9.1.
CVE-2026-65950 Medium 2026-11-11 Not applicable No public exploit A path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux could allow an attacker to write arbitrary files with the privileges of the OneCLI process by convincing a user to process a specially crafted ZIP-based update package.
CVE-2026-59191 Medium 2026-11-11 Not applicable No public exploit TwigView plugin for CakePHP provides wrappers for common View operations and extensions that expose CakePHP functions and jasny/twig-extensions helpers. Prior to versions 1.3.3 and 2.1.2, if FileLoader::findTemplate() is supplied un-validated user controlled data, arbitrary files can be read. This issue has been patched in versions 1.3.3 and 2.1.2.
CVE-2026-126776 Medium 2026-11-11 Not applicable No public exploit SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that allows attackers to write files outside the import directory via backslash-encoded filenames. Attackers controlling a URL fetched by the MCP web_fetch or http_request tools can use %5C-encoded ..\ sequences to write chosen response bytes to directories above temp/import that are writable by the SiYuan user.
CVE-2026-119529 Medium 2026-11-11 Not applicable Exploited The Gravity Forms WordPress plugin before 3.2.2 does not properly restrict the file types that unauthenticated users can upload through its chunked file upload feature, allowing them to read server environment variables and the contents of files within the web root on servers configured to parse Server-Side Include documents, such as Apache with SSI enabled.
CVE-2026-110992 Medium 2026-11-11 Not applicable No public exploit A user who can create Git Sync provisioning jobs (the Editor role by default) could delete or move files outside the configured repository path with a job that references a resource whose source path contains ../ sequences (path traversal). With a local filesystem repository on versions before 13.0.4 and 13.1.1, this reached files on the Grafana host.
CVE-2026-125357 Medium 2026-11-10 Not applicable Working exploit published Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of Munin::Master::HTML::handle_request that allows unauthenticated attackers to read files outside the static directory. Attackers can request /static/../<file> to bypass the '/../' substring check and read munin.conf and plugin-conf.d files containing monitored service credentials.
CVE-2026-123267 Medium 2026-11-10 Not applicable No public exploit CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to access unauthorized files or directories outside the intended restrictions. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.
CVE-2026-123181 Medium 2026-11-10 Not applicable No public exploit A path traversal vulnerability in Ivanti Sentry before versions 11.0, 10.8.3, and 10.7.4 allows a remote authenticated attacker with administrative privileges to create arbitrary directories and files with root privileges.
CVE-2026-119905 Medium 2026-11-10 Not applicable No public exploit Improper input validation in Windows DNS allows an authorized attacker to perform spoofing over a network.
CVE-2026-110516 Medium 2026-11-10 Not applicable No public exploit The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not validate a shortcode attribute before using it to build a file path that is included and executed, which could allow users with the contributor role and above to include and execute arbitrary local PHP files on the server.
CVE-2026-86692 Medium 2026-11-09 Not applicable No public exploit In apport before 2.37.0, a path traversal vulnerability allows an attacker who can supply a crafted crash report to cause unintended file creation or overwrite outside the intended extraction directory when the report is processed with apport-unpack. The key-name validation added for CVE-2026-77113 does not cover base64-encoded keys skipped by ProblemReport.load(binary=False), and ProblemReport.extract_keys() writes them to a file path built from the key without validation. This allows an attacker to create or overwrite arbitrary files writable by the invoking user, such as .bashrc or .profile, gaining persistence or code execution in that user's context.
CVE-2026-77473 Medium 2026-11-09 Not applicable No public exploit AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Prior to 2.24.1, recursive remote-to-local SFTP copies in SFTPClient._copy() in asyncssh/sftp.py, reached through get(), mget(), and copy(), trust filenames returned by a remote server's directory enumeration. A malicious or compromised SFTP server can return an absolute filename or a filename containing path separators and parent-directory traversal, causing destination path construction to escape the requested local directory and write attacker-selected content to locations writable by the client process. This issue is fixed in version 2.24.1.
CVE-2026-60117 Medium 2026-11-09 Not applicable No public exploit The Android implementation of the Flutter/Dart receive_sharing_intent package, versions 1.4.1 through 1.9.0, contains a path traversal vulnerability in FileDirectory.getDataColumn that allows a malicious co-resident application to write files outside the intended cache directory by supplying a crafted _display_name value from an untrusted ContentProvider. Attackers can use a path-shaped display name ../databases/proof.txt combined with a controlled content stream to write to arbitrary locations within the receiving application's private sandbox under its UID, achieving file overwrite without user interaction.
CVE-2026-125113 Medium 2026-11-09 Not applicable Proof of concept only The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdXrootdXeq.cc rejects a parent-directory component only when two dots are followed by a slash and does not reject a terminal two-dot component. An unauthenticated attacker can append /.. to an exported path in xrdfs ls or an HTTP PROPFIND request, bypass the all.export directory scope, and cause directory and filename enumeration in the parent directory under oss.localroot. The demonstrated vector does not permit file download or disclose file contents. This issue is fixed in version 5.9.2.
CVE-2026-124636 Medium 2026-11-09 Not applicable No public exploit A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function save_page of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack is possible. Upgrading to version 3.7.3 is sufficient to fix this issue. The patch is named 71f5b0de2ecb2bb2934048ed40e1155c107484e3. The affected component should be upgraded. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.
CVE-2026-124572 Medium 2026-11-09 Not applicable No public exploit A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The researcher claims to have submitted a GHSA on the repository of the project.
CVE-2026-124564 Medium 2026-11-09 Not applicable No public exploit A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-124557 Medium 2026-11-09 Not applicable No public exploit A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may be performed from remote. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-124509 Medium 2026-11-09 Not applicable Proof of concept only A vulnerability was identified in floci-io Floci up to 2.1.0. The affected element is the function S3Destination.bucketName of the file services/firehose/model/DeliveryStreamDescription.java of the component S3 Destination Configuration Handler. Such manipulation of the argument BucketARN leads to path traversal. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. The name of the patch is b986b95074ef524019be7af51e1df172e48faa4b. You should upgrade the affected component.
CVE-2026-124508 Medium 2026-11-09 Not applicable No public exploit A vulnerability was determined in floci-io Floci up to 2.4.0. Impacted is the function BuildspecParser.parseArtifacts of the file src/main/java/io/github/hectorvent/floci/services/codebuild/CodeBuildJsonHandler.java of the component Artifact Handler. This manipulation of the argument buildspecOverride.artifacts.base-directory causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-113437 Medium 2026-11-09 Not applicable No public exploit Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted.
CVE-2026-81542 Medium 2026-11-08 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.
CVE-2026-17437 Medium 2026-11-08 Not applicable No public exploit IBM App Connect Enterprise 13.0.1.0 through 13.0.8.2, and 12.0.1.0 through 12.0.12.29 could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction.
CVE-2026-16433 Medium 2026-11-08 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
CVE-2026-16427 Medium 2026-11-08 Not applicable No public exploit IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to write arbitrary files due to a path traversal vulnerability.
CVE-2026-14437 Medium 2026-11-08 Not applicable No public exploit IBM Storage Scale 5.2.3.0 through 5.2.3.9 and 6.0.1.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system.
CVE-2026-17230 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
CVE-2026-16719 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
CVE-2026-16679 Medium 2026-11-07 Not applicable No public exploit IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to view arbitrary files on the system due to a path traversal vulnerability. A specially crafted URL request could allow directories outside the intended location to be accessed.
CVE-2026-122265 Medium 2026-11-07 Not applicable No public exploit The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().
CVE-2026-120560 Medium 2026-11-07 Not applicable No public exploit The Active Woot Products Tables for WooCommerce. 100% FREE plugin for WordPress is vulnerable to Media Library File Deletion in all versions up to, and including, 2.1.5 This is due to the `get_table_data()` AJAX handler — registered for unauthenticated access via `wp_ajax_nopriv_woot_get_table_data` — performing no nonce verification and no capability check before passing the attacker-supplied `wp_columns_actions` parameter directly to `apply_filters()` alongside an attacker-controlled integer derived from the `table_id` parameter. This makes it possible for unauthenticated attackers to delete any WordPress media library attachment and its underlying file in the uploads directory by supplying a known or guessed numeric attachment ID, enabling complete erasure of a site's media library. Exploitation is achievable because WordPress core registers `wp_delete_attachment()` as a callback on hooks such as `upgrader_scheduled_cleanup` and `importer_scheduled_cleanup`, which `sanitize_key()` does not strip; notably, only attachment posts reachable by numeric ID are affected, and files outside `wp-content/uploads` — such as `wp-config.php` or plugin PHP files — cannot be targeted through this path.
CVE-2026-110004 Medium 2026-11-07 Not applicable No public exploit The wpForo Forum plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the theme_delete function in all versions up to, and including, 3.2.2 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). This exploit chain is reachable only on sites where an administrator has created a custom wpForo secondary usergroup with a blank WordPress role and the 'mth' (Manage Themes) capability; on such sites, an attacker can self-register and claim that group via the unguarded wpforo_secondary_groupids[] POST field, bypassing the role-based group filter and gaining theme-management access as a Subscriber.
CVE-2026-92080 Medium 2026-11-06 Not applicable No public exploit Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.8 before 1.1.0.
CVE-2026-75598 Medium 2026-11-06 Protected by Waratek Proof of concept only The Gradle Shadow plugin creates fat or uber JARs and supports file transformation and package relocation. Prior to version 9.6.0, Shadow does not independently validate ZIP entry names before writing them to its output archive. A malicious dependency can cause traversal entry names to be preserved when the applicable archive-processing path does not reject them. Some affected Shadow implementations process dependency archives directly, so upgrading Gradle alone does not universally prevent this behavior. If the resulting archive is extracted without path traversal protection, attacker-controlled files can be written outside the intended destination. This issue is fixed in version 9.6.0.
CVE-2026-69128 Medium 2026-11-06 Not applicable Proof of concept only Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In 5.2.2, the AI SQL blocklist omitted sibling PostgreSQL filesystem functions and failed to match double-quoted identifier forms of denied functions. The vulnerable surface is the AI query tool's PostgreSQL SQL-validation blocklist. A team Owner or Admin uses an AI-enabled PostgreSQL connection whose database role can call server-side file functions and causes generated SQL to use an unlisted sibling function or a double-quoted denied function. Unlisted sibling functions remain allowed, and double-quoted function identifiers bypass the denylist regular expressions and reach PostgreSQL. AI features must be enabled and the user must have elevated Chartbrew privileges. A PostgreSQL superuser or pg_read_server_files role can resolve absolute paths to files readable by the PostgreSQL OS user, while a non-superuser is limited to the source-stated PGDATA-relative scope. This vulnerability is fixed in 5.2.3.
CVE-2026-63663 Medium 2026-11-06 Not applicable No public exploit CloudBeaver is a cloud database manager. From version 23.2.3 until 26.1.2, a path traversal vulnerability in its SQL result-editing functionality allows an authenticated user with SQL result-editing privileges to cause the server to open files outside the intended temporary upload directory. In affected database value-handling scenarios, this can disclose local files readable by the CloudBeaver server process. Version 26.1.2 prevents traversal outside the intended temporary upload directory.
CVE-2026-55449 Medium 2026-11-06 Not applicable No public exploit CloudBeaver is a cloud database manager. Prior to 26.1.2, its resource-management project resolution accepts project identifiers without validating that they are safe path components. An authenticated user with resource-management privileges can supply a crafted project identifier that causes path resolution to escape the shared-projects directory and enumerate directory names elsewhere on the server. This can disclose filesystem layout information. Arbitrary file reads, writes, and deletion are not confirmed. The issue is fixed in 26.1.2 by validating project names before resolving the shared-project path.
CVE-2026-124029 Medium 2026-11-06 Not applicable Proof of concept only Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory.
CVE-2026-108262 Medium 2026-11-06 Not applicable No public exploit DDEV is an open-source tool for running local web development environments for PHP and Node.js. From 1.25.2 until 1.25.4, Untar in pkg/archive/archive.go validates an absolute tar symlink target after rebasing it beneath dest, but creates the symlink with the raw absolute Linkname. A crafted archive can therefore plant a host-absolute symlink and use a following regular-file entry to write outside the extraction directory. The flaw is reachable through remote add-on retrieval and database or file imports, and overwriting shell startup files, Git hooks, or cron entries can lead to code execution in the DDEV user's context. Unzip is not affected. This issue is fixed in version 1.25.4.
CVE-2026-105422 Medium 2026-11-06 Not applicable No public exploit Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute pardus-boot-repair allows Path Traversal. This issue affects pardus-boot-repair: from 1.0.9 before 1.1.0.
CVE-2026-76152 Medium 2026-11-05 Not applicable No public exploit Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via re-encoded and republished product content, and to write a re-encoded image to an arbitrary directory writable by the OFBiz process via crafted productId and imageName parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-76150 Medium 2026-11-05 Not applicable No public exploit Path traversal and missing authorization check in the replaceImageToExistImage service in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to overwrite arbitrary files writable by the OFBiz process with JPEG-encoded content via crafted productId, dataResourceNameExist, and dataResourceNameReplace parameters. Users are recommended to upgrade to version 24.09.08, which fixes this issue.
CVE-2026-68509 Medium 2026-11-05 Not applicable No public exploit FairEmail is a fully featured, open source, privacy-friendly email app for Android. Prior to 1.2325, shared attachment handling does not adequately sanitize an attacker-controlled filename before constructing its destination path. A local attacker-controlled app can therefore supply path components that escape the intended shared attachment directory and overwrite or corrupt files in the FairEmail private data directory, including account or message databases. Exploitation requires app lock using PIN or biometric authentication and user interaction to unlock FairEmail. This issue is fixed in version 1.2325.
CVE-2026-102943 Medium 2026-11-05 Not applicable No public exploit Dagu is a workflow engine with a built-in Web user interface. Prior to version 2.11.0, its MCP  dagu_read  operation with target  dag_spec  invokes the DAG specification API directly, bypassing the HTTP middleware introduced for CVE-2026-33344. The underlying resolver does not restrict resolved paths to configured DAG directories. An authenticated attacker with a viewer-role API key can supply an absolute or traversing path to read  .yaml  or  .yml  files outside those directories that are accessible to the Dagu process. The affected operation does not provide write or execution capability. This issue is fixed in version 2.11.0.
CVE-2026-76806 Medium 2026-11-04 Not applicable No public exploit Solidtime is an open-source time-tracking app. Prior to 0.16.0, TogglDataImporter::importData() read attacker-controlled project id values from projects.json in uploaded ZIP imports and concatenated them into filesystem paths without validation. Because Spatie\TemporaryDirectory\TemporaryDirectory::path() creates missing parent directories, traversal sequences could escape the temporary sandbox and create directories at arbitrary writable host paths. Distinguishable ImportController responses for existing versus missing targets exposed whether suffix-constrained host paths derived from projects_users/{id}.json or tasks/{id}.json existed, because the importer always appended .json. Any registered user able to create an organization and use POST /api/v1/organizations/{org}/import with type=toggl_data_importer could reach the flaw, potentially causing minor availability impact through directory exhaustion and disclosing host layout information. This issue is fixed in version 0.16.0.
CVE-2026-58128 Medium 2026-11-04 Not applicable Proof of concept only Alan: Health Insurance for Android (com.alanmobile) 1.450.0 contains a path traversal vulnerability that allows a co-resident malicious application to write attacker-controlled files outside the intended directory via the exported ShareReceiverActivity, which uses an unsanitized _display_name value from a shared content URI to construct the destination file path. Attackers can send a crafted ACTION_SEND intent with a _display_name containing directory traversal sequences to overwrite sensitive files within the app's sandbox such as databases, shared_prefs, and WebView data, enabling state tampering or code execution in the app's context without authentication or user interaction.
CVE-2026-57565 Medium 2026-11-04 Not applicable Proof of concept only Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the apps/readest-app/src/pages/api/storage/upload.ts route constructed an object key from the authenticated user's identifier and a client-controlled fileName without rejecting path separators or parent-directory traversal. In the R2 backend, apps/readest-app/src/utils/r2.ts placed that key into a new Request URL before signing it, and URL normalization collapsed parent-directory components so the resulting presigned PUT could escape the caller's namespace. An authenticated attacker who knew a target user identifier and book hash could overwrite or poison that user's stored book object and corrupt the associated file_key metadata; the exact cross-tenant escape was verified for the R2 backend. This issue is fixed in version 0.11.10.
CVE-2026-16725 Medium 2026-11-04 Not applicable No public exploit IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote authenticated attacker to read arbitrary files from the local filesystem due to path traversal.
CVE-2026-115426 Medium 2026-11-04 Not applicable No public exploit The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before using it to create directories and write files, allowing administrators to cause those directories and files to be created outside the intended backup location via path traversal.
CVE-2026-115242 Medium 2026-11-04 Not applicable No public exploit The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its staging-start handler, applying only a generic text filter while the sibling writability-check handler applies the correct filename sanitizer, so an authenticated administrator can supply a path containing traversal sequences and make the WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 write the copied site files outside the WordPress installation directory.
CVE-2026-89229 Medium 2026-11-03 Not applicable No public exploit Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the ShareActivity component of BlueLM Copilot (com.vivo.ai.copilot) allows a malicious application installed on the same device to write arbitrary files via a crafted ACTION_SEND intent with a ContentProvider-supplied file name containing '..' sequences.
CVE-2026-63478 Medium 2026-11-03 Not applicable Proof of concept only isomorphic-git is a pure JavaScript implementation of Git for Node.js and browsers. Prior to 1.38.6, isomorphic-git's tree parser in src/models/GitTree.js accepts a standalone .. tree-entry name because it rejects only path separators. During clone or checkout from a malicious or man-in-the-middle-controlled non-GitHub remote, nested .. entries can escape the working-tree root and write files at attacker-selected parent paths on any host-backed fs provider. The arbitrary file write can overwrite startup or configuration files and lead to code execution. GitHub-hosted trees are not a direct source because GitHub rejects .. entries during repository integrity checks. This issue is fixed in version 1.38.6.
CVE-2026-63436 Medium 2026-11-03 Protected by Waratek Proof of concept only zt-zip is a Java library that provides convenience methods for ZIP archive manipulation. Prior to 1.18.0, the Zips.get(zip).unpack().destination(outputDir).process() fluent API in src/main/java/org/zeroturnaround/zip/Zips.java constructs output files directly from ZIP entry names without applying the destination-boundary validation used by ZipUtil.unpack(...). A crafted entry containing parent-directory traversal can therefore write outside outputDir through both the normal copy branch and the ZipEntryTransformer branch. Applications that extract untrusted archives only through ZipUtil.unpack(...) are unaffected because that API already calls checkDestinationFileForTraversal. This issue is fixed in version 1.18.0.
CVE-2026-121544 Medium 2026-11-03 Not applicable Proof of concept only Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that allows authenticated attackers to read files outside the upload directory. Attackers can upload a crafted books.db with a cover value containing ../ sequences, then request /opds/cover/{key} to read files accessible to the server process.
CVE-2026-121453 Medium 2026-11-03 Not applicable No public exploit SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated workspace administrators to read files via an unsanitized filePath parameter. Attackers can supply absolute paths or ../ sequences to import CSV or spreadsheet files, including other workspaces' uploads and server files, into queryable excel_* tables.
CVE-2026-120544 Medium 2026-11-03 Not applicable No public exploit The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary .html files on the server. The plugin appends a '.html' extension to the attacker-supplied path before reading it, so files with any other extension — including wp-config.php — are out of reach. The file's contents are returned in full in the REST JSON response's content field.
CVE-2026-108327 Medium 2026-11-03 Not applicable No public exploit Tanium addressed a path traversal vulnerability in Tanium Data Service.
CVE-2026-91911 Medium 2026-11-02 Not applicable No public exploit Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
CVE-2026-91910 Medium 2026-11-02 Not applicable No public exploit Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Information exposure.
CVE-2026-91903 Medium 2026-11-02 Not applicable No public exploit Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
CVE-2026-49935 Medium 2026-11-02 Not applicable No public exploit In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-120324 Medium 2026-11-02 Not applicable Proof of concept only A weakness has been identified in Aklivity Zilla up to 1.3.4/2.4.7/2.5.0-rc2. The affected element is the function Path.resolve of the file FileSystemServerFactory of the component http-filesystem Binding. This manipulation of the argument params causes path traversal. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.5.0-rc3 is sufficient to fix this issue. Patch name: 46a8b15cbea157f7ae8b7cb865809a02fd6b1988. You should upgrade the affected component.
CVE-2026-120214 Medium 2026-11-02 Not applicable No public exploit @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix. In versions 11.6.0 through 11.6.2, the destination validation normalizes literal backslashes before it percent-decodes the request path, so a path that encodes its backslashes and dot-segments survives the dot-segment check and is only turned into backslash and double-dot sequences after that check has passed. When the upstream resolves on a platform that treats a backslash as a path separator, the forwarded request walks out of the configured proxy prefix and reaches a sibling location on the upstream. An unauthenticated remote attacker can use this to retrieve upstream resources outside the intended prefix, so the impact is confidentiality only, and exploitation depends on the upstream's path handling. The issue is fixed in @fastify/http-proxy 11.6.3, and users should upgrade to 11.6.3 or later. This is a follow-up to the earlier prefix-escape fix, which did not account for the encoded-backslash form.
CVE-2026-119480 Medium 2026-11-01 Not applicable No public exploit Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Path Traversal.This issue affects JetFormBuilder: from n/a through 3.6.7.1.
CVE-2026-120210 Medium 2026-10-31 Not applicable No public exploit FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files outside the package via unvalidated ASSETMAP Path elements. Attackers can supply a crafted IMF package with '..' or absolute paths to demux local MXF files, probe file existence and size, or trigger server-side requests.
CVE-2026-120204 Medium 2026-10-31 Not applicable No public exploit DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to create arbitrary directories via the output_dir parameter. Attackers, including cross-site GET requests from an operator's browser, can write chrome trace files to exhaust disk or inodes and use error messages as a filesystem oracle.
CVE-2026-110251 Medium 2026-10-31 Not applicable No public exploit The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to unauthorized Media Library File Deletion in all versions up to, and including, 1.2.31. This is due to the `delete_reviews_image()` function's `delete_comment` hook trusting attachment IDs supplied via the `wcpr_image_upload_id` POST parameter that were stored in comment meta without any ownership or capability check — `viwcpr_filter_review_image_ids()` verifies only that each submitted ID refers to an attachment post type, not that the submitter uploaded or owns it. This makes it possible for unauthenticated attackers to permanently delete any WordPress media library attachment — including its files on disk as recorded by `wp_delete_attachment()` — by embedding attacker-chosen attachment IDs into a review comment, then waiting for a moderator to remove the review or for WordPress core's `wp_scheduled_delete` cron to purge it after `EMPTY_TRASH_DAYS`. The nonce required to submit the parameter (`wcpr_image_upload`) is a shared public value printed on every product page for guest commenters and does not function as an authentication barrier, making this trivially exploitable without any account.
CVE-2026-61725 Medium 2026-10-30 Not applicable Proof of concept only sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or overwrite files outside the destination directory. In `src/util/decompress.rs`, `decompress_impl` computes each destination with `dest.join(entry.name())` without normalizing the archive's UTF-16 entry name or verifying containment, and `default_entry_extract_fn` writes to it with `File::create`. Parent-directory components escape the extraction root, and an absolute entry path makes the join discard the destination entirely. The convenience entry points `decompress`, `decompress_file`, `decompress_with_password`, and `decompress_file_with_password` all use this default path. Overwriting writable configuration, startup, cron, or build files can lead to code execution or persistence. The archive bytes are the attacker-controlled trust boundary, including for applications that automatically unpack uploaded or otherwise untrusted archives. This issue is fixed in version 0.21.1.
CVE-2026-119546 Medium 2026-10-30 Not applicable Proof of concept only Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allows attackers to read files outside the dump directory via crafted asset paths. Attackers can supply a dump whose release.yml DownloadURL or PatchURL contains ../ sequences, importing files like app.ini as release attachments when an administrator restores it.
CVE-2026-119342 Medium 2026-10-30 Not applicable Proof of concept only Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. From 2.13.1 until 2.13.2, the POST /api/v1/convert/svg/pdf endpoint renders attacker-supplied SVG through Apache Batik, and a scheme-less root-relative image reference bypasses SvgSanitizer.isExternalUrl() before Batik resolves it against the file:///input.svg document base as a same-origin local file. The convert() and addSvgAsPage() paths in app/core/src/main/java/stirling/software/SPDF/utils/SvgToPdf.java can then render image-decodable server files into the returned PDF when sanitization is enabled, including without authentication on login-disabled deployments or with non-admin access when login is enabled. The issue discloses PNG, JPG, GIF, or SVG content and provides an existence oracle only for image-decodable paths; plain text, binary files, directories, XInclude text, external entities, explicit file URLs, and tested HTTP references are not disclosed through this mechanism. This issue is fixed in version 2.13.2.
CVE-2026-119328 Medium 2026-10-30 Not applicable Proof of concept only Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immich_ml/main.py accepted an options object and passed its values into model construction in machine-learning/immich_ml/models/base.py without restricting security-sensitive parameters. An attacker with network access to the service could set cache_dir to an arbitrary writable path, causing model downloads to write there and causing clear_cache() to pass that path to shutil.rmtree() after selected model-loading failures. Depending on filesystem permissions and the selected path, this could modify files in mounted data locations or recursively delete an attacker-selected directory. The model-name allowlist prevents this issue from becoming arbitrary-model deserialization or code execution. This issue is fixed in version 3.3.0.
CVE-2026-115604 Medium 2026-10-30 Not applicable No public exploit Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.
CVE-2026-104739 Medium 2026-10-30 Not applicable No public exploit The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the setSupportCustomImage function in all versions up to, and including, 5.0.1. This makes it possible for authenticated attackers, with administrator-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Exploitation requires a two-step sequence: an administrator first saves a traversal-crafted value in the support_custom_img configuration field, then triggers deletion by uploading a new support custom image, at which point setSupportCustomImage() resolves and deletes the attacker-controlled path.
CVE-2026-90871 Medium 2026-10-29 Not applicable No public exploit Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow an unauthenticated attacker to affect files outside the intended directory.
CVE-2026-80067 Medium 2026-10-29 Not applicable No public exploit MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stm_lms_step parameter passed to the stm_lms_import_sample_data AJAX action, which lacks capability checks and nonce verification. Attackers can traverse the file system to reference a reachable WXR file and have the handler publish its contained posts under their identity, enabling publication of attacker-chosen post type, title, content, and metadata.
CVE-2026-77819 Medium 2026-10-29 Not applicable No public exploit IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to improper limitation of a pathname to a restricted directory.
CVE-2026-113692 Medium 2026-10-29 Not applicable No public exploit Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory.
CVE-2026-113576 Medium 2026-10-29 Not applicable No public exploit Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Scope is changed.
CVE-2026-110190 Medium 2026-10-29 Not applicable No public exploit IBM Langflow OSS 1.0.0 through 1.12.4 could allow an authenticated user to traverse directories on the system. An attacker could send a specially crafted URL request to view arbitrary files on the system.
CVE-2026-104312 Medium 2026-10-29 Not applicable No public exploit IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file write on the victim's host.
CVE-2026-104309 Medium 2026-10-29 Not applicable No public exploit IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory.
CVE-2026-86388 Medium 2026-10-28 Not applicable No public exploit Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker.
CVE-2026-86383 Medium 2026-10-28 Not applicable No public exploit Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
CVE-2026-75520 Medium 2026-10-28 Not applicable No public exploit Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in `main/WebServerCmds.cpp`, performed no `session.rights` check before invoking a Lua parser script, while its sibling command handlers gate access by role. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input through the `GET /json.htm` endpoint with `type=command` and `param=udevices`. The `script` parameter also lacked a `..` path-traversal guard: `CLuaHandler::executeLuaScript` in `main/LuaHandler.cpp` constructed the filename from the parser directory and the supplied script name before passing it to `luaL_loadfile`. Execution is limited to already-installed valid Lua files; this is not arbitrary code execution, and the advisory states that file-write and upload paths require administrator privileges. This issue is addressed in version 2026.3.
CVE-2026-118756 Medium 2026-10-28 Not applicable No public exploit gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ entry names in Prune and IsDir. Collaborators with write access to a shared git-synced store can introduce crafted entries, causing a victim's recursive gopass rm -r to delete arbitrary directory trees.
CVE-2026-118680 Medium 2026-10-28 Not applicable Proof of concept only SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBALROOT-prefixed path to copy the API token and TLS private key into the publicly served assets directory.
CVE-2026-118667 Medium 2026-10-28 Not applicable No public exploit LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4.6, and from langgraph 1.2.3 until 1.2.14 when RemoteGraph v3 streaming uses an affected langgraph-sdk version, the synchronous and asynchronous v3 stream get_tree and _fetch_state helpers interpolate caller-controlled assistant_id and thread_id values into authenticated GET request paths without using _quote_path_param. Relative path segments can therefore be normalized into another readable path on the configured server while retaining authentication headers. This issue is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14.
CVE-2026-118654 Medium 2026-10-28 Not applicable Proof of concept only Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route even though the corresponding direct path is protected by route-level middleware. An unauthenticated attacker can read files that an application intended to protect with route-level middleware, when those files are also reachable through a static filesystem mount after path normalization. This vulnerability is the result of an incomplete fix for CVE-2026-55677. This issue is fixed in 4.16.0 and 5.4.0.
CVE-2026-117626 Medium 2026-10-28 Protected by Waratek No public exploit Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the file browser for workspaces and $JENKINS_HOME/userContent/, allowing attackers with Overall/Read permission to obtain the names, sizes, and last modification times of files in the $JENKINS_HOME, and attackers with Item/Workspace permission to obtain the names of jobs that have a workspace on the same agent.
‹ prev page 1 of 43 next ›