PT-2026-91053

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files...

CVE-2023-45858: Relative Path Traversal

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files...

Microsoft Power Automate for Desktop < 2.71.115.26224 Elevation of Privilege (September 2026)

The version of Microsoft Power Automate for desktop installed on the remote Windows host is prior to 2.71.115.26224. It is, therefore, affected by an elevation of privilege vulnerability. Relative path traversal in Power Automate allows an authorized attacker to elevate privileges locally. Note...

Amazon Linux 2023 : mount-s3 (ALAS2023-2026-2137)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-2137 advisory. libgit2 Submodule path traversal CVE-2026-53584 Tenable has extracted the preceding description block directly from the tested product security advisory. Note that Nessus has not tested for this issue...

Fedora 45 : perl-DBI (2026-2bf3261da2)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2bf3261da2 advisory. 1.653 Fix test for 32bit-perl Fix arbitrary module and file loading via dbmtype/dbmmldbm CVE-2026-78030 Tighten symlink outside of fdir CVE-2026-153...

PT-2026-91758

Name of the Vulnerable Software and Affected Versions DevSpace versions prior to 6.3.22 Description The software fails to reject parent-directory segments in tar entry names originating from the in-pod sync stream. This allows an attacker operating a malicious container to stream tar entries...

EUVD-2023-60668

A directory traversal was identified in Paessler PRTG before 23.4.88.1429 that made it possible to read local files...

curl: Encoded slash traversal in the IPFS/IPNS URL rewrite escapes the configured gateway namespace

curl 8.22.0's IPFS/IPNS CLI rewrite decodes the user path after its first dot-segment cleanup, then places that decoded path after the configured gateway base and /ipfs/ or /ipns/ namespace. An encoded slash can therefore become a structural separator too late for the first cleanup, and the final...

CVE-2026-49030

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2025-70820

Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder...

CVE-2025-70819

Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../../../../../etc:/hetc:rw in a compose file...

Exploit for CVE-2026-85706

CVE-2026-85706 Unauthenticated path traversal / arbitrary fil...

CVE-2026-90774

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

EUVD-2026-76995

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774 rustypaste before 0.18.1 Path Traversal via filename header

rustypaste before 0.18.1 validates the destination path before applying the optional custom filename HTTP header, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to...

CVE-2026-90774

rustypaste before 0.18.1 is vulnerable to a path traversal via the optional custom filename HTTP header. The root cause is that the destination path is validated before the filename header is applied, so an attacker can supply traversal sequences (e.g., ../) in the header to write files outside t...

CVE-2026-90494

A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any w...

CVE-2026-90494 restify node-restify static.js serveStatic path traversal

A flaw has been found in restify node-restify up to 12.0.0. This affects the function serveStatic in the library /lib/plugins/static.js. This manipulation causes path traversal. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any w...