20237 matches found
CVE-2026-107777
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account...
EUVD-2026-102896
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account...
CVE-2026-107777 Thermo Fisher Torrent Suite Software Path Traversal
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account...
CVE-2026-107777
The Thermo Fisher Torrent Suite Software is vulnerable to a path traversal vulnerability. This flaw could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account. While no known public exploitation has been reported, CISA recomm...
CVE-2026-93767
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...
EUVD-2026-102665
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...
CVE-2026-104769
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...
EUVD-2026-102616
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...
CVE-2026-104769 Debloat <= 1.3.0 - Unauthenticated Arbitrary File Read via 's' Search Parameter via @import url() in Reflected Search-Feed <link>
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...
CVE-2026-93767: Improper Limitation of a Pathname to a Restricted Directory
The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'guid' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server,...
CVE-2026-104769: Improper Limitation of a Pathname to a Restricted Directory
The Debloat – Remove Unused CSS, Optimize JS plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 's' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents o...
PT-2026-116012
AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database connections by supplying jdbcUrl and jdbcDriverClass values to the data-dts /jobJdbcDatasource/test endpoint. Attackers can supply a MySQL JDBC URL with...
CVE-2026-107777: Improper Limitation of a Pathname to a Restricted Directory
Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files on the Torrent Server that are accessible to the web service account...
PT-2026-115622
Name of the Vulnerable Software and Affected Versions Thermo Fisher Torrent Suite Software affected versions not specified Description An authenticated attacker can exploit a path traversal flaw to read arbitrary files on the Torrent Server that are accessible to the web service account. This iss...
PT-2026-115484
Name of the Vulnerable Software and Affected Versions Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers versions prior to 3.7.5 Description An issue exists where unauthenticated attackers can perform PHP Object Injection through the deserialization of untrusted input...
Directory Traversal
Overview kedro-datasets is a Kedro-Datasets is where you can find all of Kedro's data connectors. Affected versions of this package are vulnerable to Directory Traversal via PartitionedDataset, where partition IDs are concatenated directly with the dataset base path without validation. An attacke...
CVE-2026-105037
EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets...
CVE-2026-105032
The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper...
CVE-2026-111093
In JetBrains Datalore before 2026.2.1 unauthenticated path traversal via the report blob endpoint allowed reading arbitrary files...
Astra Linux – Vulnerability in LibreOffice
Improper limitation of a pathname to a restricted directory “Path Traversal” vulnerability in The Document Foundation LibreOffice allows for absolute path traversal. An attacker can write to arbitrary locations, even those prefixed with “.ttf”, by providing a file in a format that supports embedd...