CVE-2026-15056: Improper Limitation of a Pathname to a Restricted Directory

The StoreEngine — Complete eCommerce Solution with Memberships, Licensing, Affiliates & More plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.1 via the parsefilepath function. This makes it possible for authenticated attackers, with vendor-level...

CVE-2026-17604: Improper Limitation of a Pathname to a Restricted Directory

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.1.1 via the 'data' parameter parameter. This makes it possible for authenticated attackers, with editor-level access and above, to read...

PT-2026-73104

Name of the Vulnerable Software and Affected Versions StoreEngine versions prior to 2.1.2 Description The StoreEngine plugin for WordPress contains a directory traversal flaw within the parse file path function. This issue allows authenticated users with vendor-level permissions or higher to read...

PT-2026-73133

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.1.2 Description This issue involves a Directory Traversal flaw where authenticated attackers with editor-level access or higher can read arbitrary files on the...

SUSE CVE-2026-49145

App::Ack versions through 3.10.0 for Perl read arbitrary files via --files-from in a project .ackrc. ack searches up the directory hierarchy from the current directory for a project .ackrc and loads its options. The project-source option blocklist in App::Ack::ConfigLoader does not include...

Exploit for Missing Authentication for Critical Function in Oracle Peoplesoft_Enterprise

CVE-2023-22047---Oracle-PeopleSoft-LFI CVE-2023-22047...

VulnCheck KEV: CVE-2016-5312

Directory traversal vulnerability in the charting component in Symantec Messaging Gateway before 10.6.2 allows remote authenticated users to read arbitrary files via a .. dot dot in the sn parameter to brightmail/servlet/com.ve.kavachart.servlet.ChartStream...

SUSE CVE-2026-16033

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory specifically affecti...

CVE-2026-34492 Airwall - Arbitrary file read

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-34492 Airwall - Arbitrary file read

External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...

CVE-2026-57471

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-73619

A flaw was found in GitPython. This vulnerability allows an attacker to read arbitrary files from the filesystem. By exploiting an incomplete denylist in the unsafegitarchiveoptions guard, an attacker can supply specific options, such as --add-file or --add-virtual-file, to the Repo.archive...

CVE-2026-45774

A flaw was found in compliance-trestle. The library's profile import mechanism, which handles trestle:// URIs and relative file paths, does not properly validate paths. This allows a remote attacker to craft a malicious OSCAL Open Security Controls Assessment Language profile YAML file containing...

CVE-2026-73620

A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the IndexFile.checkout and TagReference.create functions. An authenticated attacker can exploit this by passing unsafe options through keyword arguments, leading to the ability to...

CVE-2026-57471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-57471

CVE-2026-57471 affects KUNBUS RevPiPyLoad 0.11.0 via the XML-RPC management interface. A path traversal flaw in the file management component allows a local unauthenticated attacker to read arbitrary files with the RevPiPyLoad daemon’s privileges by sending crafted requests to the local managemen...

EUVD-2026-58677

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-57471

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-57471 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in KUNBUS RevPiPyLoad

Nozomi Networks Labs identified a CWE-22: Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in the file management functionality of the XML-RPC management interface of KUNBUS RevPiPyLoad in version 0.11.0 that allows a local unauthenticated attacker to rea...

CVE-2026-72820

Grav versions before 2.0.13 fail to properly validate backup profile root paths, allowing attackers to archive directories outside GRAVROOT when not in the hard-coded deny-list. Attackers with profile editor access can configure backup profiles with traversal paths to expose sensitive files from...