EUVD-2026-80179

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

CVE-2026-76550 WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...

CVE-2026-76550 WP Import Export Lite < 3.9.34 - Authenticated RCE via Export Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.34 does not validate a user-supplied output path when writing export files, allowing users granted its export permission to write files with arbitrary names to arbitrary locations on the server, leading to remote code execution...

CVE-2026-76550

The WP Import Export Lite WordPress plugin versions before 3.9.34 is vulnerable to Remote Code Execution (RCE) . The root cause is a failure to validate a user-supplied output path when writing export files, which allows authenticated users with export permissions to write files with arbitrary na...

CVE-2026-76553 WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-76553 WP Import Export Lite < 3.9.33 - Authenticated Arbitrary Directory Deletion via Template Path Traversal

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a path taken from stored, user-supplied data before recursively deleting the directory it resolves to, allowing users to whom an administrator has delegated a WP Import Export Lite WordPress plugin before 3.9.33 capability...

CVE-2026-76553

The WP Import Export Lite WordPress plugin (versions before 3.9.33 ) is vulnerable to authenticated arbitrary directory deletion . The root cause is a failure to validate a path derived from stored, user-supplied data before performing a recursive deletion of the resolved directory. This allows u...

CLEANSTART-2026-GW77529 Previously, resolving relative paths containing parent directory ('

Multiple security vulnerabilities affect the velero-plugin-for-csi package. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

SUSE CVE-2026-82035

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...

PT-2026-93999

Name of the Vulnerable Software and Affected Versions Cisco Nexus Dashboard affected versions not specified Description An issue exists involving the improper limitation of a pathname, which is categorized as a path traversal flaw. This allows potential access to files or directories outside of t...

PT-2026-94034

Name of the Vulnerable Software and Affected Versions BC Security Empire versions prior to 6.7.1 Description Authenticated operators can write files to arbitrary paths on the C2 server because the software fails to validate the multipart filename parameter in upload endpoints. By using path...

CVE-2026-92604: Improper Limitation of a Pathname to a Restricted Directory

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's id field to escape...

CVE-2026-76424: Relative Path Traversal

A vulnerability in the REST API of Cisco ISE could allow an authenticated, remote attacker to upload or copy arbitrary files on an affected device. This vulnerability is due to insufficient validation in file operations. An attacker could exploit this vulnerability by uploading a file with a...

CVE-2026-92748: Improper Limitation of a Pathname to a Restricted Directory

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-92791: Improper Limitation of a Pathname to a Restricted Directory

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/tag endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the...

CVE-2026-92816: Improper Limitation of a Pathname to a Restricted Directory

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-85731: Improper Limitation of a Pathname to a Restricted Directory

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

CVE-2026-86071: Improper Limitation of a Pathname to a Restricted Directory

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile validat...

PT-2026-93941

Name of the Vulnerable Software and Affected Versions Apache NiFi Registry versions 0.4.0 through 2.11.0 Description An issue exists during the storage of extension bundle content when using group, artifact, and version coordinates from uploaded NAR manifests. The default file persistence provide...

PT-2026-93877

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's id field to escape...