EUVD-2026-120065

A security flaw has been discovered in kevquirk PureBlog up to 3.7.2. The affected element is the function savepage of the file includes/lib/content.php of the component Page Editor. Performing a manipulation of the argument page slug results in path traversal. Remote exploitation of the attack i...

EUVD-2026-120069

A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges...

CVE-2026-124636

A security flaw in kevquirk PureBlog versions up to 3.7.2 allows for path traversal via the Page Editor component. The vulnerability exists in the save_page function of the includes/lib/content.php file, where a manipulated page slug argument can be exploited. Remote exploitation of this attack i...

CVE-2026-104620

A path traversal attack exists in the simulation of actions within the Zypp backend of PackageKit versions prior to 1.4.1 . This vulnerability could allow local attackers to escalate privileges to root . No specific exploit details or remediation steps are provided in the documents.

CVE-2026-104620

A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges...

HostCMS Path Traversal

The vulnerability in the HostCMS website management system is related to improper restriction of the path name for the directory. Exploitation of this vulnerability may allow a remote attacker to execute arbitrary code...

Webasyst Shop-Script CMS Path Traversal

The vulnerability of the Webasyst content management framework and the Shop-Script CMS system lies in incorrect restrictions on the path to the catalog. Exploiting this vulnerability can allow an attacker to gain unauthorized access to local files and directories on the server...

CVE-2026-124589

The lxtGH OMG-Seg software (up to commit f3b26b609bae919760cd3ccf09c36179bb8624a0 ) is vulnerable to a path traversal flaw in the MoE Shard Checkpoint Loader component. Specifically, the load_state_dict_into_model function within omg_llava/xtuner/utils/handle_moe_load_and_save.py fails to properl...

EUVD-2026-119924

A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a0. This affects the function loadstatedictintomodel of the file omgllava/xtuner/utils/handlemoeloadandsave.py of the component MoE Shard Checkpoint Loader. Executing a manipulation of the argument weightm...

EUVD-2026-119879

A vulnerability was identified in WebTorrent up to 2.8.5/3.0.21. Affected by this vulnerability is the function getFileModtimes of the file torrent.js of the component File Path Handler. Such manipulation of the argument file.path leads to path traversal. The attack may be performed from remote...

CVE-2026-124582

A path traversal vulnerability exists in WebTorrent versions up to 2.8.5/3.0.21 . The issue is located in the getFileModtimes function within the torrent.js file of the File Path Handler component. By manipulating the file.path argument, a remote attacker may perform a path traversal attack. Whil...

CVE-2026-113437

A Path Traversal vulnerability exists in SS1/SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. The root cause involves improper limitation of pathnames to a restricted directory (CWE-22), which may allow an attacker to delete arbitrary files . No specifi...

EUVD-2026-119875

Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd. and the ODM product rocoeyes provided by Rococo Co. Ltd. Arbitrary files may be deleted...

CVE-2026-124572

A path traversal vulnerability exists in the DataLinkDC dinky software, affecting versions up to 1.2.5 . The flaw is located within the Catalogue Upload API component, specifically in the CatalogueController.upload function of the dinky-admin/src/main/java/org/dinky/controller/CatalogueController...

EUVD-2026-119837

A vulnerability has been found in DataLinkDC dinky up to 1.2.5. Affected by this issue is the function CatalogueController.upload of the file dinky-admin/src/main/java/org/dinky/controller/CatalogueController.java of the component Catalogue Upload API. The manipulation leads to path traversal. Th...

CVE-2026-124564

A path traversal vulnerability exists in the HNAP Handler component of the D-Link DIR-878 (version 1.20B05). The flaw is triggered by the manipulation of the ListDirectoryPath argument within the GetListDirectory function located in bin/prog.cgi. This weakness allows for remote exploitation , and...

EUVD-2026-119795

A weakness has been identified in D-Link DIR-878 1.20B05. Affected by this issue is the function GetListDirectory of the file bin/prog.cgi of the component HNAP Handler. This manipulation of the argument ListDirectoryPath causes path traversal. Remote exploitation of the attack is possible. The...

CVE-2026-124557

A vulnerability was detected in OtterMind Chat2DB up to 5.3.8. Impacted is the function DbMybatisGenerateServiceImpl.generateClass of the file DbMybatisGenerateServiceImpl.java of the component Class Generator. The manipulation of the argument tableName results in path traversal. The attack may b...

Traccar - Unrestricted File Upload

Traccar is an open source GPS tracking system. Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. Since the system allows registration by default, attackers can acquire ordinary user permissions by registering an account and exploit this...

CVE-2026-124557

OtterMind Chat2DB versions up to 5.3.8 are vulnerable to a path traversal flaw within the Class Generator component. Specifically, the DbMybatisGenerateServiceImpl.generateClass function fails to properly sanitize the tableName argument, allowing an attacker to perform path traversal. This vulner...