133411 matches found
EUVD-2026-75775
IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability...
EUVD-2025-210887
Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url...
CVE-2026-77807
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 11.0.4 via the username Parameter. This makes it possible for unauthenticated attackers to read the conten...
CVE-2026-90445: Improper Limitation of a Pathname to a Restricted Directory
An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain within the intended destination directory. This allows an authenticated attacker to craft an archive whose entries traverse outside the...
PT-2026-90514
Name of the Vulnerable Software and Affected Versions Elasticsearch affected versions not specified Description An API endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request to the underlying search and analytics data store without restricting its...
PT-2026-89754
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the upload file remove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $ POST when no real $ FILES upload is provided process accoun...
CVE-2026-19991: Improper Limitation of a Pathname to a Restricted Directory
The UsersWP plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.2.70 via the uploadfileremove AJAX handler. The plugin stores the value of an account 'file' form field taken directly from $POST when no real $FILES upload is provided processaccount cal...
PT-2026-89908
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...
CVE-2026-89065: Relative Path Traversal
Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers to recursively delete files and directories outside the project directory that are writable by the environment running projen, via crafted entries in the...
CVE-2025-69904
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...
CVE-2025-69904
Linkstack version v4.8.4 and earlier is vulnerable to a Path Traversal flaw. This vulnerability allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation can result in unauthorized access to sensitive system or application files. No spe...
PT-2026-89810
a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...
PT-2026-90508
libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean uri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...
CVE-2026-87727: Improper Limitation of a Pathname to a Restricted Directory
a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbitrary files on the affected product...
PT-2026-90513
Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted file paths remain...
CVE-2025-69904: Improper Limitation of a Pathname to a Restricted Directory
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...
CVE-2026-87910: Improper Limitation of a Pathname to a Restricted Directory
When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, the filter function is run twice: once for the extracted member, and once with name set to the location of the link. For one of the calls, the return value was...
EUVD-2025-210892
Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read arbitrary files on the server by manipulating file path input. Successful exploitation may lead to unauthorized access to sensitive system or application files...
CVE-2026-89009: Absolute Path Traversal
WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1V250922 contain an unauthenticated arbitrary file write vulnerability that allows remote attackers to overwrite any file on the device by sending a crafted payload to the syncserver daemon on TCP port 13136. The daemon, which runs...
PT-2026-90016
Name of the Vulnerable Software and Affected Versions Linkstack versions prior to 4.8.5 Description Path Traversal allows an administrator to read arbitrary files on the server by manipulating file path input. This issue can lead to unauthorized access to sensitive system or application files...