135028 matches found
CVE-2026-96419 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark
Profile import crash in 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 allows denial of service and possible code execution...
CVE-2026-96419
A profile import crash in Wireshark versions 4.6.0 to 4.6.8 and 4.4.0 to 4.4.18 can lead to a denial of service and potential code execution . The root cause is identified as an incorrect limitation on the path name to the restricted directory within the WiresharkZipHelper::unzip() function. This...
CVE-2026-8066
A directory traversal vulnerability exists in the file upload functionality of the Hitachi Energy RTU500 . This flaw allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Successful exploitation may lead to the unauthorized modification of device data...
CVE-2026-8066
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in...
EUVD-2026-88669
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in...
CVE-2026-8066
A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depending on the files affected, successful exploitation could result in...
CVE-2026-96440
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...
CVE-2026-91012
org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...
BIT-RCLONE-2026-93987 rclone serve docker Path Traversal via Volume Name
rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the rclone serve docker volume plugin. newVolume in cmd/serve/docker/volume.go computes a volume's mountpoint as filepath.Joindrv.root, name from the attacker-supplied name field of a Docker VolumeDriver.Create reques...
BIT-RCLONE-2026-93986 rclone before 1.75.1 Path Traversal via Directory Listing Names
rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal sequences in object names. Attackers can craft special names containing forward slashes and parent directory references to potentially write outside the...
CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...
CVE-2026-96440
Flowring Agentflow 4.0 (versions prior to 2023/03/24) is vulnerable to a Path Traversal flaw in the /WebAgenda/download/uploadFile.jsp API endpoint. This vulnerability allows remote authenticated users to write files to arbitrary locations outside the intended upload directory by manipulating the...
CVE-2026-96440 Flowring Agentflow 4.0 - Improper Limitation of a Pathname to a Restricted Directory（Path Traversal）
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...
EUVD-2026-88665
Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version before 2023/03/24 allows remote authenticated users to write files to arbitrary locations outside the intended upload directory via...
EUVD-2026-88663
Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files etc/org.apache.karaf.command.acl..cfg. SecuredSessionFactoryImpl.checkSecurity resolves the roles required for an invocation and, when no ACL rule matches the command, fails...
CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...
EUVD-2026-88660
org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...
CVE-2026-91012
A path traversal vulnerability exists in Apache Karaf within the org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties) method, which supports the config MBean and config: oo shell commands. The root cause is the lack of validation to ensure that caller-supplied input stay...
CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...
CVE-2026-91012 Apache Karaf: Path Traversal in Config Service Allows Manager-to-Admin Privilege Escalation
org.apache.karaf.config.core.impl.ConfigRepositoryImplupdatepid, properties, which backs the "config" MBean and the config: shell commands, derives the file it writes a configuration to from caller-supplied input without checking that the result stays inside $karaf.etc: if the submitted property...