CVE-2026-85409

Eleveo Quality Management 9.7.0 is affected by a path traversal vulnerability in the QuestionnaireService.runDataExportNow function of the Questionnaire Service component. Manipulating the file_name argument allows a remote attacker with low privileges to read, modify, or delete files outside the...

CVE-2026-85409 Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The...

CVE-2026-85409 Eleveo Quality Management Questionnaire Service QuestionnaireService.runDataExportNow path traversal

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The...

EUVD-2026-70790

MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and...

EUVD-2026-70851

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...

CVE-2026-67397

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...

PT-2026-85398

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument file name leads to path traversal. The attack may be performed from remote. The...

PT-2026-85554

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL FILES PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

CVE-2026-74235: Improper Limitation of a Pathname to a Restricted Directory

GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcfhandledownload function accepts parameters prefixed with vdel and appends their values directly to the base configuration directory path without...

PT-2026-85745

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

PT-2026-85539

Name of the Vulnerable Software and Affected Versions firecrawl-mcp-server version 3.20.2 Description An arbitrary local file read issue exists in the firecrawl parse tool. The tool accepts unconstrained filePath arguments without performing directory containment validation, allowing attackers to...

PT-2026-86163

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip function extracts all ZIP entries via ZipArchive::extractTo without validating entry paths for ../ traversal sequences. Only the first entry's subdirectory structure is checked. An attacker can overwrite...

Linux Distros Unpatched Vulnerability : CVE-2026-85396

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entryextract that fails to properly validate extraction paths using prefix comparis...

RHEL 9 : python3.12 (RHSA-2026:63117)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:63117 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

Flextype CMS 1.0.0-alpha.3 Remote Code Execution

Flextype CMS version 1.0.0-alpha.3 contains a remote code execution vulnerability in the interaction between the Entries API and Shortcodes::registerShortcodes. The /api/v1/entries endpoint accepts an attacker-controlled entry identifier that can contain path traversal sequences, allowing content...

CVE-2026-85409: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in Eleveo Quality Management 9.7.0. The affected element is the function QuestionnaireService.runDataExportNow of the component Questionnaire Service. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote. The...

Fedora 43 : composer (2026-0425df0537)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-0425df0537 advisory. Version 2.10.3 - 2026-08-27 Security: Validate package bin paths against path traversal using symlinks GHSA-96h3-5x6v-m776, CVE-2026-59944 Security:...

PT-2026-85669

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal...

CVE-2026-85603: External Control of File Name or Path

Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language code parameter. An authenticated admin user with admin.pages.create permission can supply directory traversal sequences in the lang POST field to write...

CVE-2026-67397: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...