The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B arises from incorrect pathname restrictions in the catalog. This allows attackers to bypass security restrictions.

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to incorrect path name restrictions in the catalog. Exploiting this vulnerability can allow an attacker to bypass security restrictions...

The vulnerability of the JFrog Artifactory repository management platform, related to deficiencies in path name restrictions for restricted catalogs, allows attackers to write arbitrary files.

The vulnerability of the JFrog Artifactory repository management platform is related to deficiencies in path name restrictions for restricted catalogs. Exploiting this vulnerability could allow a malicious actor to write arbitrary files...

The vulnerabilities of the S3 API Gateway and Iceberg REST Catalog Gateway of the distributed file system SeaweedFS allow a perpetrator to gain unauthorized access for reading and writing data.

The vulnerability of the S3 API Gateway and Iceberg REST Catalog Gateway components of the distributed file system SeaweedFS is related to incorrect path name restrictions for catalogs. Exploiting this vulnerability could allow an attacker to gain unauthorized read and write access to data...

The vulnerability of the Python programming language’s pip module arises from incorrect pathname restrictions for directories, allowing attackers to compromise the integrity of protected information.

The vulnerability of the Python programming language’s pip module is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

The vulnerability of the local development servers for Vite and Vite+ relates to incorrect path name restrictions for the catalog, which allows attackers to expose protected information.

The vulnerability of the Vite and Vite+ application development local servers is related to incorrect restrictions on path names to the catalog. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the Flask-Reuploaded server’s file loading library, related to an incorrect path name limitation for the directory, allows attackers to gain unauthorized access to write arbitrary files or execute arbitrary code.

The vulnerability of the Flask-Reuploaded file loading library is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to write arbitrary files or execute arbitrary code by injecting templates at t...

The vulnerability of Adobe Experience Manager’s content and media data management system, related to incorrect restrictions on path names to the catalog, allows attackers to bypass existing security mechanisms.

The vulnerability of the Adobe Media Encoder application relates to incorrect restrictions on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to bypass existing security measures remotely...

PT-2026-63356

n8n before 1.123.64, 2.29.8, and 2.30.1 contains a TOCTOU race condition in the Git node's clone operation that allows authenticated users to bypass path restrictions by swapping a directory for a symlink after the path is validated but before the clone runs. This lets an attacker plant a crafted...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

CVE-2026-8920

The vulnerability CVE-2026-8920 concerns ASUS Aura Wallpaper Service. It describes Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path, enabling a local user to perform file operations by sending crafted commands that contain an arbitrary ...

PT-2026-58877

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

ROS-20260714-73-0065

The vulnerability in Grafana relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260713-73-0006

The vulnerability of the File.ReadDir and File.Readdir functions in the Go programming language is related to improper restrictions on the path to a limited directory. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information...

The vulnerability of the Vite application development local server relates to incorrect path name restrictions for the directory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Vite application development local server is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the ColdFusion software platform arises from an incorrect limitation on the path to the restricted access catalog. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the ColdFusion software platform exists due to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2026-56377

A flaw in ImageMagick’s policy enforcement allows remote attackers to bypass path restrictions within sandboxed conversion services. By circumventing these controls, an attacker can create or truncate files outside permitted security boundaries, leading to unauthorized file manipulation. Mitigati...

CVE-2026-12243

A flaw was found in NLTK. An attacker can exploit a path traversal vulnerability by providing specially crafted input to nltk.data.load or nltk.data.find. This allows the attacker to read arbitrary files accessible to the Python process, leading to information disclosure. The vulnerability arises...