PT-2026-90016

Name of the Vulnerable Software and Affected Versions Linkstack versions prior to 4.8.5 Description Path Traversal allows an administrator to read arbitrary files on the server by manipulating file path input. This issue can lead to unauthorized access to sensitive system or application files...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via improper sanitization of .. in the Remote process. An attacker can manipulate file paths to escape the intended backend confinement by supplying specially crafted object names containing directory traversal...

CVE-2026-52097

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, afLaunchLocalUri urllauncher.dart, OpenFilex.open, localPathRegex commonpatterns.dart components...

CVE-2026-79692

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access...

EUVD-2026-74851

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access...

CVE-2026-79692

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access...

CVE-2026-86741: External Control of File Name or Path

Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers with low-privilege permissions can inject markdown image syntax or raw HTML img tags pointing to local files or remote URLs, which the mail auto-embed librar...

PT-2026-88941

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access...

CVE-2026-78620 Improper Path Validation in Okta Access Gateway Kerberos Configuration Handling

The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents. The path from the event payload is used directly as the write destination, resulting in files being written to unintended locations on the appliance...

CVE-2026-69805

External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-73923

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally...

CVE-2026-69383

CVE-2026-69383 is a local elevation of privilege vulnerability in Windows Shell , caused by external control of file name or path . An authorized attacker with low privileges can exploit this to gain full control over confidentiality, integrity, and availability of the system (CVSS 3.1 base score...

EUVD-2026-73131

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

Windows Shell Elevation of Privilege Vulnerability

External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally...

Microsoft Word Remote Code Execution Vulnerability

External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally...

Microsoft Exchange Server Remote Code Execution Vulnerability

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network...

PT-2026-87731

Name of the Vulnerable Software and Affected Versions .NET affected versions not specified Description External control of a file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version...

CVE-2026-47680: Relative Path Traversal

The source-controller is a Kubernetes operator, specialised in artifacts acquisition from external sources such as Git, OCI, Helm repositories and S3-compatible buckets. In versions 0.0.17 through 1.8.4, an actor with the ability to influence the contents of a bucket referenced by a Bucket resour...

Microsoft Exchange Server (September 2026)

The Microsoft Exchange Server installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities: - Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network. CVE-2026-55007 - External control of file name...

CVE-2026-81830

A flaw was found in OpenVPN. The Windows interactive service in OpenVPN contains an incorrect file path validation vulnerability. A local authenticated user could exploit this flaw to bypass the trusted configuration directory constraint, leading to a security bypass and potential integrity...