CVE-2026-63445

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-rc.0, list endpoints used with the file-system database bind the request-controlled project query parameter into the resource Query structure without validating it against directory traversal...

CVE-2025-14753

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

EUVD-2025-210936

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2026-7006 Sublime Text 4192/3207 Local Privilege Escalation via Update Staging Mechanism

Sublime Text for Windows through Build 4192 Sublime Text 4 and Build 3207 Sublime Text 3 contains a local privilege escalation vulnerability that allows unprivileged local attackers to execute arbitrary code with elevated privileges by abusing the update staging mechanism. Attackers can place a...

CVE-2026-88623

NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is received, and fopen is used to open the URL in binary read-only mode. The content is then written to the /tmp/ directory, with the filename derived from basename ...

CVE-2026-16777

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-14323

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server...

EUVD-2026-82758

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-16777

The Store Exporter WordPress plugin (for WooCommerce) is affected by a directory traversal vulnerability in all versions up to and including 2.8.0 . The flaw resides in the filename parameter , which is insufficiently validated, allowing authenticated attackers with Shop Manager privileges or hig...

CVE-2026-16777 Store Exporter <= 2.8.0 - Authenticated (Shop Manager+) Path Traversal to Arbitrary File Read and Arbitrary File Deletion via 'filename' Parameter

The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.0 via the 'filename' parameter parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-14323 Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server...

CVE-2026-14323

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is affected by a Directory Traversal vulnerability (all versions up to and including 2.8.5 ) via the 'mockups' parameter, allowing unauthenticated attackers to read arbitrary files on the server containing sensitive ...

CVE-2026-14323 Printcart Web to Print Product Designer for WooCommerce <= 2.8.5 - Unauthenticated Arbitrary File Read via 'folder' and 'mockups' Parameters

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server...

EUVD-2026-82754

The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8.5 via the 'mockups' parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

github.com/go-git/go-git: github.com/go-git/go-git/v5: go-git: Unauthorized file modification via directory traversal in reference names

A flaw was found in go-git, an extensible Git implementation library. Maliciously crafted reference names, which can contain directory-traversal sequences, are not properly sanitized. This vulnerability allows an attacker to write files outside of the intended reference storage directory,...

PT-2026-95669

Name of the Vulnerable Software and Affected Versions IBM Guardium Data Protection version 12.2 Description A path traversal issue allows a remote authenticated attacker to access and traverse directories on the system. Path traversal is a flaw that allows an attacker to use special characters to...

CVE-2025-14753: Improper Limitation of a Pathname to a Restricted Directory

IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

PT-2026-95636

Name of the Vulnerable Software and Affected Versions cockpit-files affected versions not specified Description A race condition exists during directory creation with owner assignment. A local unprivileged attacker who controls a writable parent directory can replace a newly created directory wit...

PT-2026-95435

Name of the Vulnerable Software and Affected Versions IBM Cloud Pak for Data version 5.1.2 Description A remote attacker can perform directory traversal on the system by sending a specially crafted URL request containing "dot dot" sequences /../. This allows the attacker to view arbitrary files o...