Office Online Package ONLYOFFICE Docs Path Traversal

The vulnerability of the office online package ONLYOFFICE Docs DocumentServer is related to incorrect restrictions on the path to the catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Online Store Path Traversal

The vulnerability of software platforms for developing and managing online stores like Magento Open Source, Adobe Commerce, and Adobe Commerce B2B is related to incorrect path name restrictions in the catalog. Exploiting this vulnerability can allow an attacker to bypass security restrictions...

JFrog Artifactory Path Traversal

The vulnerability of the JFrog Artifactory repository management platform is related to deficiencies in path name restrictions for restricted catalogs. Exploiting this vulnerability could allow a malicious actor to write arbitrary files...

SeaweedFS S3 API Gateway Iceberg REST Catalog Gateway Unauthorized Access

The vulnerability of the S3 API Gateway and Iceberg REST Catalog Gateway components of the distributed file system SeaweedFS is related to incorrect path name restrictions for catalogs. Exploiting this vulnerability could allow an attacker to gain unauthorized read and write access to data...

Python pip Directory Restriction

The vulnerability of the Python programming language’s pip module is related to an incorrect limitation on the path name for the directory. Exploiting this vulnerability could allow an attacker to compromise the integrity of the protected information...

Vite Local Development Path Traversal

The vulnerability of the Vite and Vite+ application development local servers is related to incorrect restrictions on path names to the catalog. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

PT Application Inspector Path Traversal

The vulnerability of the PT Application Inspector’s software for detecting vulnerabilities and errors is related to incorrect restrictions on the path to the catalog. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

Flask-Reuploaded Path Traversal

The vulnerability of the Flask-Reuploaded file loading library is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow an attacker to gain unauthorized access to write arbitrary files or execute arbitrary code by injecting templates at t...

PT-2026-63356

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64 n8n versions prior to 2.29.8 n8n versions prior to 2.30.1 Description A TOCTOU Time-of-Check to Time-of-Use race condition exists in the Git node's clone operation. This occurs when an authenticated user swaps a...

Adobe Experience Manager Path Traversal

The vulnerability of the Adobe Media Encoder application relates to incorrect restrictions on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to bypass existing security measures remotely...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

CVE-2026-8920

The vulnerability CVE-2026-8920 concerns ASUS Aura Wallpaper Service. It describes Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path, enabling a local user to perform file operations by sending crafted commands that contain an arbitrary ...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

CVE-2026-8920

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

PT-2026-58877

Improper Restriction of Communication Channel to Intended Endpoints and External Control of File Name or Path in Aura Wallpaper Service allow a local user to perform file operations by sending crafted commands containing an arbitrary file path and bypassing the service’s path restrictions . On...

PT-2026-58976

Summary Anyquery's server mode lacks input sanitization and access control over its built-in SQLite virtual table modules e.g., csv reader, log reader. Unauthenticated attackers connecting to the MySQL-compatible server port can create virtual tables pointing to local files on the system e.g.,...

ROS-20260714-73-0065

The vulnerability in Grafana relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

ROS-20260713-73-0006

The vulnerability of the File.ReadDir and File.Readdir functions in the Go programming language is related to improper restrictions on the path to a limited directory. Exploiting this vulnerability allows an attacker to gain unauthorized access to protected information...

Vite Local Server Path Traversal

The vulnerability of the Vite application development local server is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...