PT-2026-95149

Name of the Vulnerable Software and Affected Versions AI Agent Automation versions prior to 0.9.1 Description An authenticated user capable of creating or modifying workflow file steps can exploit a path traversal flaw in the executeStep file-step implementation located in...

CVE-2026-54670: Improper Limitation of a Pathname to a Restricted Directory

WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts attacker-controlled nomeClasse and metodo values without a complete controller and method allowlist, exempts sensitive...

PT-2026-95015

Name of the Vulnerable Software and Affected Versions mport versions prior to 2.7.8 Description The MidnightBSD Package Manager contains an issue where the create sample file function in libmport/bundle read install pkg.c fails to constrain absolute source and destination paths from the sample-fi...

CVE-2026-93014: Improper Limitation of a Pathname to a Restricted Directory

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-directory sequences to escape upload directories and delete CSS, XML, JSON resource...

CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...

EulerOS 2.0 SP15 : python3 (EulerOS-SA-2026-3819)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same...

SUSE SLES15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4208-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4208-1 advisory. - CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. - CVE-2026-20338: invalid free due to bad...

EulerOS 2.0 SP15 : python3 (EulerOS-SA-2026-3794)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same...

Fortra GoAnywhere Managed File Transfer (MFT) < 7.10.2 Path Traversal (CVE-2026-15913)

According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer MFT running on the remote host is prior to 7.10.2. It is, therefore, affected by a path traversal vulnerability in the /attachRemoteFiles endpoint which allows Web Users with both Secure Folders and...

CVE-2026-54585: Improper Limitation of a Pathname to a Restricted Directory

mport is the MidnightBSD Package Manager. Prior to 2.7.8, createsamplefile in libmport/bundlereadinstallpkg.c did not constrain absolute source and destination paths from the sample-file manifest directive to mport-root. A malicious or malformed package manifest could therefore direct privileged...

CVE-2026-92812

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

CVE-2026-92791

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/tag endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the...

CVE-2026-92748

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-76409

As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...

CVE-2026-92816

ComfyUI versions before 0.30.0 contain a path traversal vulnerability in dataset save nodes (comfy_extras/nodes_dataset.py). The folder_name input is not properly sanitized, allowing an attacker to write files to arbitrary paths outside the intended output directory. By loading a crafted workflow...

CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-92816 ComfyUI before 0.30.0 Path Traversal via dataset save nodes

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

EUVD-2026-81070

decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator validation. Attackers can access sibling directories whose names begin with the repository directory name to read, write, or delete files outsi...

CVE-2026-92812

decap-server , the local server component of the decap-cms content management system, is affected by a path traversal vulnerability in its local proxy containment guard. The guard performs a plain string prefix comparison without validating path separators, allowing attackers to access sibling di...