Overview 29 matches · 0 in Waratek scope · 0 protected · 1 exploited · 0 CISA KEV · 3 public PoC · 2 EPSS ≥ 0.5
29matches
0in Waratek scope0.0%
0protected0.0%
1exploited3.4%
0CISA KEV0.0%
3public PoC10.3%
2EPSS ≥ 0.56.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
29
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
29
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 12 / year
20181
Not applicable1
Critical1
not blocked1
No public exploit1
20190
20201
Not applicable1
Critical1
not blocked1
Forecast only1
20210
20220
20231
Not applicable1
Critical1
not blocked1
No public exploit1
20245
Not applicable5
Critical5
not blocked5
Exploited1
Proof of concept only1
No public exploit3
20259
Not applicable9
Critical9
not blocked9
Working exploit published1
No public exploit8
202612
Not applicable12
Critical12
not blocked12
Proof of concept only4
No public exploit8
201820192020202120222023202420252026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-118633 | Critical | 2026-10-28 | Not applicable | No public exploit | A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually. |
| CVE-2026-82824 | Critical | 2026-10-01 | Not applicable | No public exploit | Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0. |
| CVE-2026-13716 | Critical | 2026-08-11 | Not applicable | Proof of concept only | Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution. |
| CVE-2026-59115 | Critical | 2026-08-07 | Not applicable | No public exploit | '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-52703 | Critical | 2026-06-15 | Not applicable | No public exploit | Unauthenticated Path Traversal in FastDup <= 2.7.2 versions. |
| CVE-2026-40128 | Critical | 2026-06-09 | Not applicable | No public exploit | SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable. |
| CVE-2026-45661 | Critical | 2026-05-29 | Not applicable | Proof of concept only | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during application deployment. When combined with Dokploy's remote server deployment feature, this vulnerability enables arbitrary file write to remote server filesystems, automatic remote code execution via cron jobs, complete server compromise, data exfiltration without user interaction, and persistent backdoor installation. This vulnerability bypasses all container isolation on remote server deployments. |
| CVE-2026-7302 | Critical | 2026-05-18 | Not applicable | No public exploit | SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints. |
| CVE-2026-45495 | Critical | 2026-05-18 | Not applicable | No public exploit | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability |
| CVE-2026-6074 | Critical | 2026-04-23 | Not applicable | No public exploit | Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory. |
| CVE-2025-59793 | Critical | 2026-02-17 | Not applicable | Proof of concept only | Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the application doesn't properly sanitize the jobDirectory parameter, which allows path traversal sequences to be included. This allows writing files to arbitrary local filesystem locations and may subsequently lead to remote code execution. |
| CVE-2025-68428 | Critical | 2026-01-05 | Not applicable | Proof of concept only | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsanitized paths to the loadFile method, a user can retrieve file contents of arbitrary files in the local file system the node process is running in. The file contents are included verbatim in the generated PDFs. Other affected methods are `addImage`, `html`, and `addFont`. Only the node.js builds of the library are affected, namely the `dist/jspdf.node.js` and `dist/jspdf.node.min.js` files. The vulnerability has been fixed in jsPDF@4.0.0. This version restricts file system access per default. This semver-major update does not introduce other breaking changes. Some workarounds areavailable. With recent node versions, jsPDF recommends using the `--permission` flag in production. The feature was introduced experimentally in v20.0.0 and is stable since v22.13.0/v23.5.0/v24.0.0. For older node versions, sanitize user-provided paths before passing them to jsPDF. |
| CVE-2025-41723 | Critical | 2025-10-22 | Not applicable | No public exploit | The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations. |
| CVE-2025-42937 | Critical | 2025-10-14 | Not applicable | No public exploit | SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application. |
| CVE-2025-53417 | Critical | 2025-08-05 | Not applicable | No public exploit | DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability |
| CVE-2025-49297 | Critical | 2025-06-09 | Not applicable | No public exploit | Path Traversal: '.../...//' vulnerability in Mikado-Themes Grill and Chow grillandchow allows PHP Local File Inclusion.This issue affects Grill and Chow: from n/a through <= 1.6. |
| CVE-2025-49296 | Critical | 2025-06-09 | Not applicable | No public exploit | Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6. |
| CVE-2025-49295 | Critical | 2025-06-09 | Not applicable | No public exploit | Path Traversal: '.../...//' vulnerability in Mikado-Themes MediClinic mediclinic allows PHP Local File Inclusion.This issue affects MediClinic: from n/a through <= 2.1. |
| CVE-2025-30515 | Critical | 2025-06-09 | Not applicable | No public exploit | CyberData 011209 Intercom could allow an authenticated attacker to upload arbitrary files to multiple locations within the system. |
| CVE-2025-5598 | Critical | 2025-06-04 | Not applicable | No public exploit | Path Traversal vulnerability in WF Steuerungstechnik GmbH airleader MASTER allows Retrieve Embedded Sensitive Data.This issue affects airleader MASTER: 3.0046. |
| CVE-2025-24786 | Critical | 2025-02-06 | Not applicable | Working exploit published | WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled). If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability. |
| CVE-2024-56045 | Critical | 2024-12-31 | Not applicable | No public exploit | Path Traversal: '.../...//' vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue affects WPLMS: from n/a through < 1.9.9.5. |
| CVE-2024-21575 | Critical | 2024-12-12 | Not applicable | No public exploit | ComfyUI-Impact-Pack is vulnerable to Path Traversal. The issue stems from missing validation of the `image.filename` field in a POST request sent to the `/upload/temp` endpoint added by the extension to the server. This results in writing arbitrary files to the file system which may, under some conditions, result in remote code execution (RCE). |
| CVE-2024-40505 | Critical | 2024-07-16 | Not applicable | No public exploit | Directory Traversal vulnerability in D-Link DAP-1650 Firmware v.1.03 allows a local attacker to escalate privileges via the hedwig.cgi component. |
| CVE-2024-39171 | Critical | 2024-07-09 | Not applicable | Proof of concept only | Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statements to .htaccess and code to a file with a .png suffix. |
| CVE-2024-2863 | Critical | 2024-03-25 | Not applicable | Exploited | This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. |
| CVE-2023-39916 | Critical | 2023-09-13 | Not applicable | No public exploit | NLnet Labs’ Routinator 0.9.0 up to and including 0.12.1 as well as 0.14.0 up to and including 0.14.2 contains a possible path traversal vulnerability in the optional, off-by-default keep-rrdp-responses feature that allows users to store the content of responses received for RRDP requests. The location of these stored responses is constructed from the URL of the request. Due to insufficient sanitation of the URL, it is possible for an attacker to craft a URL that results in the response being stored outside of the directory specified for it. |
| CVE-2020-27130 | Critical | 2020-11-17 | Not applicable | Forecast only | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of directory traversal character sequences within requests to an affected device. An attacker could exploit this vulnerability by sending a crafted request to the affected device. A successful exploit could allow the attacker to download arbitrary files from the affected device. |
| CVE-2018-3744 | Critical | 2018-05-29 | Not applicable | No public exploit | The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL. |