EUVD-2026-74546

Tanium addressed a path traversal vulnerability in Tanium Data Service...

CVE-2026-14505 Tanium addressed a path traversal vulnerability in Tanium Data Service.

Tanium addressed a path traversal vulnerability in Tanium Data Service...

CVE-2026-14505 Tanium addressed a path traversal vulnerability in Tanium Data Service.

Tanium addressed a path traversal vulnerability in Tanium Data Service...

CVE-2026-14505

Tanium Data Service contains a path traversal vulnerability that Tanium has addressed. The vulnerability requires network access , high attack complexity , and high privileges , with no user interaction needed, and can lead to high impact on confidentiality, integrity, and availability. It is rat...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Spring

Summary Multiple vulnerabilities were addressed in IBM Library Support for Spring 3.3.25 Vulnerability Details CVEID:CVE-2026-47884 DESCRIPTION: Use of XsltView in a Spring MVC application can result in SSRF and RCE attack if the application has an "/" mapping that results in view rendering, and...

SUSE CVE-2026-25718

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths...

SUSE CVE-2026-28705

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths...

SUSE CVE-2026-55588

ORAS OCI Registry As Storage is a CLI and library for managing artifacts in OCI registries. In ORAS CLI versions up to and including 1.3.2, the recursive referrer traversal does not track visited descriptors, so a malicious OCI registry that returns a cyclic referrer graph causes unbounded...

SUSE CVE-2026-55874

SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side...

PT-2026-89163

An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary files and write them outside the intended storage directory via the directory parameter in POST /app-api/infra/file/upload...

PT-2026-88967

Name of the Vulnerable Software and Affected Versions Dell SCG 5.0 Appliance versions prior to 5.36.00.16 Dell SCG 5.0 Application versions prior to 5.36.00.00 Description A Relative Path Traversal issue exists where an unauthenticated attacker with remote access can gain unauthorized access to t...

PT-2026-88837

Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege...

CVE-2026-71805

A critical arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0 . Unauthenticated remote attackers can exploit the directory parameter in the POST /app-api/infra/file/upload endpoint to upload arbitrary files and write them outside the intended storage directory. Explo...

CVE-2026-78485: Improper Limitation of a Pathname to a Restricted Directory

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability. An unauthenticated attacker with remote access could potentially exploit this...

PT-2026-89044

🚨 CVE-2026-86775 knowns npm package versions = 0.29.1 contain a path traversal vulnerability in the Document API. The HTTP handler in internal/server/routes/docs.go normalizes the user-supplied document path with cleanDocPath, which strips leading/trailing slashes and the .md suffix but does not...

CVE-2026-79728: Relative Path Traversal

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Traversal vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker...

PT-2026-89107

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

PT-2026-89157

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

PT-2026-89215

Path Traversal in Flow ID File Operations Summary @openhop/server passes unsanitized HTTP route parameters directly to path.join when constructing filesystem paths for flow YAML files. An unauthenticated attacker who can reach the server can read arbitrary .yaml files accessible to the OpenHop...

CVE-2026-19729: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...