132119 matches found
DEBIAN-CVE-2026-85526
Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...
CVE-2026-73642
Dayforce Payroll is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with file path parameter set to any path including an absolute local file path. Because vendor contact attempts were unsuccessful, the vulnerability has only been...
CVE-2026-15953
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in ABB Protection and control IED manager PCM600. This issue affects Protection and control IED manager PCM600: through 2.14...
CVE-2026-101070
A security vulnerability has been detected in dbgate up to 7.3.1. Affected by this vulnerability is the function files of the file packages/api/src/controllers/runners.js of the component Files Endpoint. The manipulation of the argument runid leads to path traversal. The attack is possible to be...
CVE-2026-85526
Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...
CVE-2026-85185
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...
CVE-2026-86334
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...
UBUNTU-CVE-2026-86334
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a...
UBUNTU-CVE-2026-85185
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...
UBUNTU-CVE-2026-85526
Path traversal in the Btrfs storage driver unpackVolume in Canonical LXD on Linux allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem as root via a crafted subvolumes.path entry in backup/optimizedheader.yaml...
CVE-2026-90925 Path Traversal in Innotim Software's Logsign SIEM
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117...
CVE-2026-90925
The Logsign SIEM software by Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. is vulnerable to a Path Traversal vulnerability. This issue affects versions 6.4.101 up to, but before, 6.4.117 . The flaw allows an attacker to access files or directories outside the intended restri...
EUVD-2026-88291
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117...
CVE-2026-90925 Path Traversal in Innotim Software's Logsign SIEM
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117...
CVE-2026-93537 Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include...
CVE-2026-93537 Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include...
CVE-2026-93537
SUSE Rancher Fleet is vulnerable to a path traversal vulnerability in the Helm valuesFiles component. An attacker with permission to supply bundle content to a GitRepo resource (e.g., via Git push access) can force the system to read arbitrary files from the filesystem of the bundle-processing en...
CVE-2026-93537 Path traversal in Fleet Helm valuesFiles allows disclosure of files outside the bundle directory
A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access, or through permission to create or modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment that processes the bundle and include...
CVE-2026-85185 Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...
CVE-2026-85185
Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8, and 6.10) on Linux are vulnerable to a path traversal flaw in the btrfs storage driver . An authenticated client with instance creation permissions can use crafted subvolume paths containing ../ sequences to delete arbitrary...