CVE-2026-77258: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment in src/mcpatlassian/confluence/attachments.py accepts a caller-controlled filepath and opens the selected server-local file without restricting it to the workspace. A...

CVE-2026-34689: Improper Limitation of a Pathname to a Restricted Directory

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...

CVE-2025-1280: Improper Limitation of a Pathname to a Restricted Directory

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libtar (UTSA-2026-090031)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090031 advisory. Multiple directory traversal vulnerabilities in the 1 tarextractglob and 2 tarextractall functions in libtar 1.2.20 and earlier allow remote attackers to overwrite...

CVE-2026-95698: Improper Limitation of a Pathname to a Restricted Directory

The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a fixed image directory and a file extension, then calls fileexists on the resulting path. The organization name field is attacker-controllable through event...

CVE-2026-95273: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch...

CVE-2026-77266: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, uploadattachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP caller with attachment access can read a chosen...

CVE-2026-77246: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, an HTTP transport deployment with READONLYMODE=false accepts a request without an Authorization identity and permits attacker-controlled Atlassian service headers, including...

RHEL 8 : tar (RHSA-2026:70390)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:70390 advisory. The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: Tar path traversal...

Adobe Connect <= 4.4 Multiple Vulnerabilities (APSB26-150)

The version of Adobe Connect installed on the remote host is prior to 4.5. It is, therefore, affected by multiple vulnerabilities as referenced in the apsb26-150 advisory. - Cross-site Scripting Reflected XSS CWE-79 potentially leading to Arbitrary code execution CVE-2026-75698 - Improper...

Linux Distros Unpatched Vulnerability : CVE-2026-93709

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler...

CVE-2026-77259: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, confluenceuploadattachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A caller can upload environment files,...

CVE-2026-95272: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function staticcontent of the file changedetectionio/flaskapp.py of the component Screenshot Handler. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate th...

CVE-2026-77271: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, validatesafepath defaults its base directory to os.getcwd, and affected Confluence attachment call sites omit basedir, allowing attacker-selected writes within the working directory...

CVE-2026-15095: Improper Limitation of a Pathname to a Restricted Directory

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-93712: Improper Limitation of a Pathname to a Restricted Directory

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: git (UTSA-2023-001354)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-001354 advisory. Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially...

CVE-2026-93712

Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the request path onto publicdir without collapsing relative segments, and checks only that the result is a readable regular file. A request...

CVE-2026-93709

Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage handler. The handler compares the request path against the layout directory name as text, while the lookup that follows canonicalises it. A doubled slash, a dot...

VulnCheck KEV: CVE-2026-93616

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...