CVE-2026-90866 Virtual Folder Path Confinement Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access locations outside their authorized scope, potentially enabling remote code execution...

CVE-2026-90866

Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows are affected by a path traversal vulnerability. This flaw allows a delegated Host Administrator to bypass virtual folder path confinement and access locations outside their authorized scope, which could potentially...

CVE-2026-90864

Progress Software WS_FTP Server on Windows versions prior to 2024.0.7 and 2025.0.4 is affected by a path traversal vulnerability. This flaw allows a delegated Host Administrator to bypass path containment and access or modify files outside of their authorized scope. The documents do not provide s...

CVE-2026-90864 Host Administrator Path Containment Bypass in Progress WS_FTP Server

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope...

EUVD-2026-113021

A path traversal vulnerability in Progress Software WSFTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to access or modify files outside their authorized scope...

EUVD-2026-113010

Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WSFTP Server versions prior to 2024.0.6 and 2025.0.3 on Windows could allow an authenticated user to access files outside intended directories...

EUVD-2026-113150

IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory...

EUVD-2026-113148

IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-generated ZIP archive containing entry paths that traverse outside the intended extraction directory. Extraction of the archive by a victim using a non-sanitizing tool could result in arbitrary file...

CVE-2026-80067

MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated Subscriber-level users to import arbitrary WXR XML files by supplying directory traversal sequences in the stmlmsstep parameter passed to the stmlmsimportsampledata AJAX action,...

CVE-2026-80069

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...

CVE-2026-113576 Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access...

CVE-2026-113576

Adobe Digital Editions is affected by a Path Traversal (CWE-22) vulnerability. This flaw allows an attacker to bypass security measures and gain unauthorized write access by exploiting an improper limitation of a pathname to a restricted directory. Successful exploitation requires user interactio...

EUVD-2026-113142

Adobe Digital Editions is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access...

CVE-2026-93571 Path Traversal in Szafir

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0 build 708...

CVE-2026-93571

The Szafir software is vulnerable to a Path Traversal vulnerability (CWE-22) involving uploaded filenames. A man-in-the-middle attacker capable of rerouting update requests to a malicious server can provide an arbitrary XML file that the system will save in a directory chosen by the attacker. Thi...

EUVD-2026-113120

Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server can prepare arbitrary XML file that will be saved in location chosen by attacker. This issue was fixed in version 2.0 build 708...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

nodejs: nodejs: Permission model bypass via wildcard path matching flaw

A flaw was found in the Node.js Permission Model. Wildcard --allow-fs-read or --allow-fs-write rules can grant access to paths that do not match the intended wildcard when the requested path is shorter than the wildcard prefix and the radix-tree lookup stops comparing early. For example,...

CVE-2026-113692

Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authenticated administrators to read files outside the intended directory...

CVE-2026-80069 MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax

MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any authenticated user, including Subscribers, to trigger the stmlmssendtestemailajax AJAX action without capability or nonce validation. Attackers can invoke this handler directly or via...