Wireshark 4.6.x < 4.6.7 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.6.7. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.7 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profi...

Linux Distros Unpatched Vulnerability : CVE-2026-96276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension...

Wireshark 4.4.x < 4.4.16 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.4.16. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.16 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profile impo...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory. - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path...

CVE-2026-79306

CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...

Wireshark 4.4.x < 4.4.16 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.4.16. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.16 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 -...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

CVE-2025-9345

Proof of Concept Path Traversal in File Manager, Code Editor, and Backup by Managefy Vulnerability Type: Path Traversal Arbitrary File Download Affected Function: ajaxdownloadfile Impact: Authenticated users with low privilege Subscriber+ can download arbitrary files from the server, including...

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 Critical. T...

CVE-2026-18133

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: ページテンプレート解決における未認証パストラバーサル WordPress Core における未認証のローカル PHP ファイルインクルード。二重エンコードされた pagename 値を通じて発生し、特定のデプロイ条件下では Web サーバーアカウントの権限で PHP コードが実行される。...

CVE-2026-18133 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

CVE-2026-18133

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a path traversal flaw (CWE-22 ). This vulnerability could allow a remote authenticated attacker to modify server files. The affected versions include 4.0.6.0 through 4.0.10.0 (specifically 4.0.6.0 iFix6, 4.0.6.0 iFix6 R...

Exploit for CVE-2026-87902

CVE-2026-87902 — PoC Unauthenticated remote code execution...

CVE-2021-33558

CVE-2021-33558 Reference: https://www.cvedetails.com/cve/CVE-2021-33558 Shodan dork: product:"Boa Web Server" 0.94.13 Payload: root@kitploit: /backup.html /preview.html /js/log.js /log.html /email.html /online-users.html /config.js POC:...

CVE-2023-2825-Gitlab

CVE-2023-2825 On May 23, 2023 GitLab released version 16.0.1 which fixed a critical vulnerability, CVE-2023-2825, affecting the Community Edition CE and Enterprise Edition EE version 16.0.0. The vulnerability allows unauthenticated users to read arbitrary files through a path traversal bug. It wa...

EUVD-2026-84005

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join...

GHSA-9VM9-PQXX-X83V KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...

KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join

Description KubeEdge keadm contains a path traversal vulnerability in the DecompressTarGz archive extraction function. Archive entry names were joined directly with the extraction destination without sufficient validation. A crafted tar.gz archive containing parent-directory components,...

MCP Atlassian: Incomplete path traversal fix allows intra-CWD module overwrite and RCE (bypass of GHSA-xjgw-4wvw-rgm4)

Summary The path traversal fix introduced in v0.17.0 GHSA-xjgw-4wvw-rgm4 is incomplete. validatesafepath is called without an explicit basedir, defaulting to os.getcwd. In standard container deployments the process CWD is the application directory e.g. /app, so paths within that directory,...