CVE-2026-33329

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler UploadModel::handleUpload is concatenated directly into filesystem paths without any sanitization. An authenticated...

CVE-2026-22739

Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from...

openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following

A flaw was found in openCryptoki, a PKCS11 library and tooling for Linux and AIX. A token-group user can exploit a symlink-following vulnerability by planting symbolic links in group-writable token directories. When an administrator runs a PKCS11 application or administrative tool as root, it may...

openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following

A flaw was found in openCryptoki, a PKCS11 library and tooling for Linux and AIX. A token-group user can exploit a symlink-following vulnerability by planting symbolic links in group-writable token directories. When an administrator runs a PKCS11 application or administrative tool as root, it may...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the readDir API endpoint. An attacker can access and enumerate arbitrary directories and retrieve file names by sending crafted requests to the endpoint. Details A Directory Traversal attack also known as path...

EUVD-2026-15578

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in designingmedia Instant VA instantva allows Path Traversal.This issue affects Instant VA: from n/a through = 1.0.1...

CVE-2026-24970

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in designingmedia Energox energox allows Path Traversal.This issue affects Energox: from n/a through = 1.2...

CVE-2026-22448

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in flexcubed PitchPrint pitchprint allows Path Traversal.This issue affects PitchPrint: from n/a through = 11.1.2...

tar-rs: unpack_in can chmod arbitrary directories by following symlinks

...

SUSE CVE-2026-28492

File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.61.0, when a user creates a public share link for a directory, the withHashFile middleware in http/public.go uses...

Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 : LibTIFF vulnerabilities (USN-8113-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8113-1 advisory. It was discovered that LibTIFF did not properly handle memory when processing certain...

PT-2026-28061

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in icopydoc YML for Yandex Market yml-for-yandex-market allows Path Traversal.This issue affects YML for Yandex Market: from n/a through 5.3.0...

PT-2026-27811

Name of the Vulnerable Software and Affected Versions flexcubed PitchPrint versions n/a through 11.1.2 Description An improper limitation of a pathname to a restricted directory, specifically a 'Path Traversal' issue, exists in flexcubed PitchPrint. This allows for Path Traversal. The issue affec...

PT-2026-27863

Name of the Vulnerable Software and Affected Versions Energox versions n/a through 1.2 Description An improper limitation of a pathname to a restricted directory 'Path Traversal' exists in designingmedia Energox energox, allowing Path Traversal. This allows an attacker to potentially access files...

PT-2026-28036

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in vanquish WooCommerce Support Ticket System woocommerce-support-ticket-system allows Path Traversal.This issue affects WooCommerce Support Ticket System: from n/a through 18.5...

PT-2026-27963

Name of the Vulnerable Software and Affected Versions AA-Team WZone woozone versions through 14.0.31 Description A flaw exists in AA-Team WZone woozone that allows for path traversal. This issue is due to improper limitation of a pathname to a restricted directory. The vulnerability could...

PT-2026-27993

Name of the Vulnerable Software and Affected Versions Whitebox-Studio Scape versions prior to 1.5.16 Description An improper limitation of a pathname to a restricted directory, known as a 'Path Traversal' issue, exists in Whitebox-Studio Scape. This allows an attacker to potentially access files...

CVE-2026-33329

FileRise is a self-hosted web file manager / WebDAV server. From version 1.0.1 to before version 3.10.0, the resumableIdentifier parameter in the Resumable.js chunked upload handler UploadModel::handleUpload is concatenated directly into filesystem paths without any sanitization. An authenticated...

openCryptoki: openCryptoki: Privilege Escalation or Data Exposure via Symlink Following

A flaw was found in openCryptoki, a PKCS11 library and tooling for Linux and AIX. A token-group user can exploit a symlink-following vulnerability by planting symbolic links in group-writable token directories. When an administrator runs a PKCS11 application or administrative tool as root, it may...

CVE-2026-22739

Vulnerability in Spring Cloud when substituting the profile parameter from a request made to the Spring Cloud Config Server configured to the native file system as a backend, because it was possible to access files outside of the configured search directories.This issue affects Spring Cloud: from...