Linux Distros Unpatched Vulnerability : CVE-2026-96276

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If a malicious SDK container declares an extension point with a crafted directory path, and a developer runs flatpak build-init --writable-sdk --sdk-extension...

CVE-2026-75887: Improper Limitation of a Pathname to a Restricted Directory

A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the lng and ns query parameters in the /locales/resource.json endpoint. This allows the attacker to read sensitive .json files from the pod filesystem, including plugi...

CVE-2026-79304: Improper Limitation of a Pathname to a Restricted Directory

CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply an arbitrary absolute or out-of-scope path in the fileName JSON property. Because...

Wireshark 4.4.x < 4.4.16 Multiple Vulnerabilities

The version of Wireshark installed on the remote Windows host is prior to 4.4.16. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.16 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profile impo...

TencentOS Server 4: bubblewrap (TSSA-2026:1022)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1022 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Wireshark 4.6.x < 4.6.7 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.6.7. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.6.7 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 - Profi...

SUSE SLES15 Security Update : php-composer2 (SUSE-SU-2026:4283-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4283-1 advisory. - CVE-2026-45793: GitHub OAuth tokens failing regex validation can cause credential disclosure bsc1271504. - CVE-2026-59944: path...

CVE-2026-79306

CyberPanel v1.9.1 is vulnerable to a path traversal vulnerability in the compress method via the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can provide absolute or out-of-scope file paths in the listOfFiles JSON property, along with ...

CVE-2026-91801: Improper Limitation of a Pathname to a Restricted Directory

A path traversal vulnerability exists in Foxit PDF Editor/Reader's handling of embedded PDF resources. Insufficient validation of resource file paths may allow files to be written outside their intended locations, potentially enabling arbitrary code execution...

CVE-2026-96651: Improper Limitation of a Pathname to a Restricted Directory

Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path traversal via '/system/agents/media/get'. A remote attacker with a valid session token could read any file that the target user can access. This access includes the...

CVE-2026-79306

CyberPanel v1.9.1 contains a path traversal vulnerability in the compress method exposed through the /filemanager/controller endpoint. An authenticated remote attacker with ownership of any configured domain can supply absolute or otherwise out-of-scope file paths in the listOfFiles JSON property...

Wireshark 4.4.x < 4.4.16 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 4.4.16. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-4.4.16 advisory. - Memory leak in sharkd 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service CVE-2026-7379 -...

CVE-2025-9345

Prueba de Concepto de Path Traversal en File Manager, Code Editor y Backup de Managefy Tipo de Vulnerabilidad: Path Traversal Descarga Arbitraria de Archivos Función Afectada: ajaxdownloadfile Impacto: Usuarios autenticados con privilegios bajos Subscriber+ pueden descargar archivos arbitrarios d...

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

On September 22, 2026, the WordPress Security Team released WordPress 7.1.2, as well as security backports for every branch back to WordPress 4.7 to address a critical unauthenticated path traversal vulnerability. The issue is tracked as CVE-2026-87902 and has a CVSS v4.0 score of 9.2 Critical. T...

CVE-2026-18133

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

cve-2026-87902-poc

CVE-2026-87902 — WordPress Core: path traversal no autenticado en la resolución de plantillas de página Inclusión local de archivos PHP no autenticada en WordPress Core mediante un valor pagename con doble codificación — y, bajo condiciones específicas de despliegue, ejecución de código PHP con l...

CVE-2026-18133 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow a remote authenticated attacker to modify server files due to path traversal...

CVE-2026-18133

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to a path traversal flaw (CWE-22 ). This vulnerability could allow a remote authenticated attacker to modify server files. The affected versions include 4.0.6.0 through 4.0.10.0 (specifically 4.0.6.0 iFix6, 4.0.6.0 iFix6 R...

Exploit for CVE-2026-87902

CVE-2026-87902 — PoC Unauthenticated remote code execution...

CVE-2021-33558

CVE-2021-33558 Referencia: https://www.cvedetails.com/cve/CVE-2021-33558 Dork de Shodan: product:"Boa Web Server" 0.94.13 Payload: /backup.html /preview.html /js/log.js /log.html /email.html /online-users.html /config.js POC:...