CVE-2026-77621: Improper Limitation of a Pathname to a Restricted Directory

Vector is a high-performance observability data pipeline. From 0.10.0 until 0.57.0, the file sink renders its templated path from event fields and opens the result without confining it to an intended directory. When an untrusted source supplies an event field used by the path template, the value...

CVE-2026-93616: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

PT-2026-96901

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The upload attachment function in src/mcp atlassian/confluence/attachments.py fails to call validate safe path, allowing it to accept a caller-controlled file path and open server-local files...

CVE-2026-77269: Improper Limitation of a Pathname to a Restricted Directory

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller can provide an absolute or traversal filepat...

PT-2026-96810

Name of the Vulnerable Software and Affected Versions Lantronix SLC8000 versions prior to 9.7.0.5 Lantronix EMG8500 versions prior to 9.7.0.1 Lantronix EMG7500 versions prior to 9.7.0.1 Lantronix SLB882 affected versions not specified Lantronix SLCx-03 affected versions not specified Lantronix...

PT-2026-96811

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.5 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified SLCx-03 affected versions not specified SLCx-02 affected versions not specified Description A...

PT-2026-96931

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions 0.17.0 through 0.21.0 Description An incomplete path traversal fix allows attacker-selected writes within the working directory. The function validate safe path defaults its base dir to the current working directory...

PT-2026-96794

Name of the Vulnerable Software and Affected Versions Vector versions 0.10.0 through 0.56.0 Description The file sink renders its templated path from event fields and opens the result without confining it to an intended directory. If an untrusted source provides an event field used by the path...

PT-2026-96654

Name of the Vulnerable Software and Affected Versions BM Content Builder versions prior to 3.17.1 Description An issue exists where authenticated users with Subscriber-level access and above can perform Directory Traversal, a technique used to access files and directories that are stored outside...

Linux Distros Unpatched Vulnerability : CVE-2026-93712

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Dancer2 versions from 2.1.0 before 2.2.0 for Perl serve files from outside publicdir via relative path segments in the File route handler. The handler joins the...

CVE-2026-94489: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...

PT-2026-96839

Name of the Vulnerable Software and Affected Versions WordPress versions 4.7.0 through 7.1.1 Description An unauthenticated path traversal flaw exists in the page-template resolution logic of the get page template function. The issue occurs because the pagename parameter is decoded late in the...

Wireshark 4.6.x < 4.6.6 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.6.6. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.6 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profile import...

PT-2026-96951

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions 0.17.0 through 0.21.0 Description A path traversal issue exists in the confluence upload attachment tool. The file path variable is passed directly to the open function without proper validation, allowing a caller to rea...

PT-2026-97090

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A path traversal issue exists that could allow a remote authenticated attacker to modify server files. Path traversal is a flaw that allows ...

VulnCheck KEV: CVE-2026-75949

Joomla Extension - cmsjunkie.com - Arbitrary file upload / deletion path traversal in J-BusinessDirectory 6.2.3 - Upload/remove accepted a client-controlled root pathtype could point at the component site/admin trees, did not enforce path containment, and used a weak extension check. CSRF token w...

CVE-2026-18133: Improper Limitation of a Pathname to a Restricted Directory

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

Moderate: tar security, bug fix, and enhancement update

The GNU tar program can save multiple files in an archive and restore files from an archive. Security Fixes: tar: Tar path traversal CVE-2025-45582 tar: tar: Hidden file injection via crafted archives CVE-2026-5704 tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path...

PT-2026-96968

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description An Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal, allows for arbitrary file system read. This issue enables an attacker to access sensitive...

CVE-2026-94489

A path traversal vulnerability in OctoPrint 1.0.0 affects the _validate function in src/octoprint/server/api/files.py (File Download API). Manipulation of the filename argument allows a remote attacker with low privileges to traverse directories, resulting in low confidentiality impact . The expl...