CVE-2026-15913 Path Traversal in Fortra's GoAnywhere MFT Endpoint

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

CVE-2026-15913 Path Traversal in Fortra's GoAnywhere MFT Endpoint

In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users with both Secure Folders and Secure Mail permissions to escape their sandboxed home directory, achieving arbitrary file read...

CVE-2026-15913

Fortra's GoAnywhere MFT versions prior to 7.10.2 are affected by a path traversal vulnerability in the /attachRemoteFiles endpoint. An authenticated Web User holding both Secure Folders and Secure Mail permissions can escape their sandboxed home directory, enabling arbitrary file read . The CNA-a...

CVE-2026-53956

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

GHSA-M4F3-G4CQ-HQRX vulnerabilities

Vulnerabilities for packages: mlflow, checkov...

CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-53956

Rattler is a library providing common functionality for the conda ecosystem. rattler_cache prior to 0.9.0 and py-rattler prior to 0.24.0 are vulnerable to package-cache path traversal . During cache materialization, the package record build string is joined into a filesystem path without proper s...

EUVD-2026-75141

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2026-53956 Rattler vulnerable to package cache path traversal via conda package build string

Rattler is a library that provides common functionality used within the conda ecosystem. rattlercache prior to version 0.9.0 and py-rattler prior to version 0.24.0 were vulnerable to package-cache path traversal when handling package metadata from conda channels. During cache materialization, the...

CVE-2025-58363

A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system...

GHSA-HR3M-4QWQ-3MGC GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

GitHacker: Path traversal in ref/hash parsing enables existence oracle and hex-fragment exfiltration via malicious .git server

Summary GitHacker through 1.1.7 did not validate path segments parsed from attacker-controlled .git/HEAD before joining them onto its output directory. A malicious server could coerce GitHacker into reading arbitrary local files. Contents do not stream back wholesale, but the recovery loop turns...

Relative Path Traversal

Overview githacker is an A multiple threads tool to download the .git folder and rebuild git repository locally. Affected versions of this package are vulnerable to Relative Path Traversal via the addheadfiletasks function. An attacker can access arbitrary local files and exfiltrate fragments of...

LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. Details In internal/plugin/native/manager.go, the plugin installation endpoint...

GHSA-C23Q-FW86-9H5X LF Edge eKuiper: Arbitrary File and Directory Deletion via Path Traversal in Plugin Installation Endpoint

Summary A path traversal vulnerability in eKuiper's administrative management endpoints allows privileged users or attackers with access to management APIs to delete arbitrary files or directories on the host system. Details In internal/plugin/native/manager.go, the plugin installation endpoint...

CVE-2026-87927

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

CVE-2026-87927

MaxSite CMS through version 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers. By supplying base64-encoded path traversal sequences, unauthenticated attackers bypass path validation checks and execute admin-gated handler actions without authentication...

CVE-2026-87927 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...

CVE-2026-87927 MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher

MaxSite CMS through 109.6 contains a local file inclusion vulnerability in the ajax and require-maxsite dispatchers that allows unauthenticated attackers to execute privileged handler files by supplying base64-encoded path traversal sequences. Attackers can bypass path validation checks and execu...