Directory Traversal

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Directory Traversal via the isPathAllowedForModule function. An attacker can access non-allowlisted modules by exploiting prefix matching in module...

Exploit for Command Injection in Microsoft

CVE-2026-49179: Active Directory WriteSPNScript Command Inject...

PT-2026-95017

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description In the MidnightBSD Package Manager, directory assets handled as ASSET DIR or ASSET DIR OWNER MODE in the libmport/bundle read install pkg.c file utilize path-based mport mkdirp, ownership, and permissi...

CVE-2026-45140: Improper Limitation of a Pathname to a Restricted Directory

Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on the server. The authoritative advisory does not identify the affected endpoint, component, input, or exploitation mechanism. This issue is...

PT-2026-95020

Name of the Vulnerable Software and Affected Versions Many Notes versions prior to 0.16.0 Description The ZIP vault import feature in the app/Actions/ProcessImportedVault.php file allows archive filenames to contain parent-directory traversal segments. This enables an authenticated user to write...

CVE-2026-76433

A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected files on an affected device. This vulnerability is due to insufficient validation of directory traversal character sequences in a...

CVE-2026-76431

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid...

CVE-2026-76432

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-92812

decap-server , the local server component of the decap-cms content management system, is affected by a path traversal vulnerability in its local proxy containment guard. The guard performs a plain string prefix comparison without validating path separators, allowing attackers to access sibling di...

CVE-2026-92812 decap-server Path Traversal via Sibling Directory Prefix Matching

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

CVE-2026-92812 decap-server Path Traversal via Sibling Directory Prefix Matching

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

EUVD-2026-81016

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid...

CVE-2026-76431 Cisco Identity Services Engine Arbitrary File Deletion Vulnerability

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid...

CVE-2026-76431 Cisco Identity Services Engine Arbitrary File Deletion Vulnerability

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid...

CVE-2026-76431

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated, remote attacker with administrative credentials to delete arbitrary files and directories on the underlying operating system. The root cause is improper va...

CVE-2026-76432 Cisco Identity Services Engine Arbitrary File Write Vulnerability

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

EUVD-2026-81156

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-76432 Cisco Identity Services Engine Arbitrary File Write Vulnerability

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-76432

A directory traversal vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC allows an authenticated, remote attacker with administrative-level privileges to write arbitrary files to any location on the affected system. The root cause is insufficient validation of dire...

CVE-2026-76433

This is a directory traversal vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC . Due to insufficient validation of directory traversal character sequences in a user-supplied path during provisioning resource requests, an unauthenticated, remote attacker can...