3781 matches found
PT-2026-76966
Name of the Vulnerable Software and Affected Versions Citrix WorkSpace App version 2607 Description An issue exists in Citrix WorkSpace App on MacOS that allows external control of a file name or path. This occurs when the application does not properly validate the file path provided by an extern...
CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
CVE-2026-42162
Mahara before 25.04.5 and 26.04.0 is vulnerable to artefacts being accessible to others under certain circumstances when the file path to an artefact in a page is manipulated...
CVE-2026-19725
The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.131 does not sanitise a value taken from an unauthenticated request before using it to build a log file path, allowing an attacker holding a site to site transfer key to create a log file in any existing writable directory of t...
CVE-2026-19725
The WPvivid — Backup, Migration & Staging WordPress plugin versions before 0.9.131 is vulnerable to an unauthenticated path traversal via the send_to_site_connect functionality. The root cause is a failure to sanitize values from an unauthenticated request used to construct a log file path. An at...
CVE-2026-34492 Airwall - Arbitrary file read
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-34492 Airwall - Arbitrary file read
External control of file name or path vulnerability in Johnson Controls Airwall allows : File Manipulation. This issue affects Airwall: before 4.1...
CVE-2026-17184
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path...
CVE-2026-17184 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path...
CVE-2026-17184
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 are affected by CVE-2026-17184, enabling a remote attacker to execute arbitrary code due to external control of a file name or path. The issue affects the GUI and related components of IBM Db2 Mirror for i. IBM’s bulletin lists remediation via platf...
EUVD-2026-58765
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path...
CVE-2026-17173
IBM Db2 Mirror for i 7.4–7.6 is affected by CVE-2026-17173, a path-traversal vulnerability caused by improper validation of file paths that could allow a remote authenticated attacker to obtain sensitive information. Affected versions: 7.4, 7.5, 7.6. Remediation: apply IBM PTFs SJ10947 (7.4), SJ1...
CVE-2026-17173 IBM Db2 Mirror for i is affected by multiple vulnerabilities
IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of file paths...
CVE-2026-73479 dua-cli Terminal Escape Sequence Injection via Marked Paths
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or oth...
EUVD-2026-58459
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths...
CVE-2026-17482
IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths...
CVE-2026-73653 Vitest: Browser Mode provider commands bypass the file-access permission gate
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied file paths without enforcing the allowWri...
EUVD-2026-57630
A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, an...