CVE-2023-22632: Improper Neutralization of Argument Delimiters in a Command

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

CVE-2026-56839: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODETOOLS wrappers keep workspaceroot as None and pass workspace=None to readfile, searchreplace, and applydiff helpers that enforce path containment only for a truthy workspace. An application that exposes codereadfile,...

PT-2026-91398

Name of the Vulnerable Software and Affected Versions PyMuPDF versions prior to 1.28.3 Description A path traversal issue exists in the extract objects function within src/ main .py. The software constructs output filenames by joining a document-controlled BaseFont name to a user-supplied output...

CVE-2026-82035: Improper Limitation of a Pathname to a Restricted Directory

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...

PT-2026-91199

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

CVE-2026-91200: Improper Limitation of a Pathname to a Restricted Directory

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...

CVE-2026-15955: Improper Limitation of a Pathname to a Restricted Directory

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2026-78299: Improper Limitation of a Pathname to a Restricted Directory

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

Linux Distros Unpatched Vulnerability : CVE-2026-82035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output...

CVE-2026-84534: Improper Limitation of a Pathname to a Restricted Directory

A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7, visionOS 27. Extracting a maliciously crafted archive may allow an attacker to write arbitrary files...

PT-2026-91596

Name of the Vulnerable Software and Affected Versions iOS versions prior to 26.7 iPadOS versions prior to 26.7 iOS versions prior to 27 iPadOS versions prior to 27 macOS Golden Gate versions prior to 27 macOS Sequoia versions prior to 15.8 macOS Tahoe versions prior to 26.7 visionOS versions prio...

CVE-2026-81565: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

CVE-2026-90774

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

EUVD-2026-76995

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774

rustypaste before 0.18.1 is vulnerable to a path traversal via the optional custom filename HTTP header. The root cause is that the destination path is validated before the filename header is applied, so an attacker can supply traversal sequences (e.g., ../) in the header to write files outside t...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

PT-2026-90841

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774: Improper Limitation of a Pathname to a Restricted Directory

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...