CVE-2026-77751 Path Traversal in MISP Object Template Resolution During STIX Import and Export in misp-stix library

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

EUVD-2026-63877

A path traversal vulnerability existed in the handling of MISP object template names during STIX 2 import and MISP-to-STIX 2 export. MISP object names are passed to PyMISP's object-template resolution mechanism, which constructs a filesystem path by joining the configured MISP object-template...

WordPress W3 Total Cache plugin < 2.10.5 - Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability

Unauthenticated Arbitrary Directory File Write and .htaccess Overwrite via Path Traversal in the Page Cache Key vulnerability discovered by Jakub Herman in WordPress Plugin W3 Total Cache versions 2.10.5...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability

Unauthenticated Arbitrary File Read and Move via Path Traversal vulnerability discovered by Sanjar Tulkinov in WordPress Plugin Simple File List versions = 6.3.11...

CVE-2026-76158

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

CVE-2026-76158

Datiphy Data Management Center (v8.3.0 through v8.5.1) contains a path traversal vulnerability in its upload API endpoint. An unauthenticated remote attacker can supply relative or absolute path sequences to write files to arbitrary locations outside the intended upload directory, enabling arbitr...

CVE-2026-76158 Datiphy Data Management Center - External Control of File Name or Path

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

EUVD-2026-63797

External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to write files to arbitrary locations outside the intended upload directory via relative or absolute path sequences...

EUVD-2026-63758

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

EUVD-2026-63626

Improper limitation of a pathname to a restricted directory 'path traversal' in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network...

EUVD-2026-63620

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network...

EUVD-2026-63735

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to bypass security restrictions due to improper limitation of a pathname to a restricted directory...

PT-2026-79498

Name of the Vulnerable Software and Affected Versions Arc Enterprise versions prior to 26.06.1 Description Arc Enterprise's Raft FSM Finite State Machine in the applyRegisterFile function accepts attacker-chosen file paths in manifest-registration proposals without validating them against the...

PT-2026-79461

Name of the Vulnerable Software and Affected Versions Atlantis versions 0.19.8 through 0.44.0 Description Atlantis fails to consistently validate user-controlled workspace values provided via the repository-level atlantis.yaml configuration or the authenticated '/api/plan' endpoint before joining...

Kibana 8.x < 8.19.17 / 9.0.x < 9.3.6 / 9.4.x < 9.4.3 Vulnerability (ESA-2026-94)

The version of Kibana installed on the remote host is 8.x prior to 8.19.17, 9.0.x prior to 9.3.6, or 9.4.x prior to 9.4.3. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-94 advisory. - Relative Path Traversal CWE-23 in Kibana can lead to the unauthorized deletion of...

PT-2026-79492

Name of the Vulnerable Software and Affected Versions LeafWiki versions 0.3.0 through 0.10.0 Description LeafWiki contains a path traversal flaw within the asset rename functionality. This issue occurs because the application fails to properly sanitize user-supplied file paths during the rename...

SUSE SLED15: libpython3_13-1_0 / python313 / python313-base / python313-curses / etc (SUSE-SU-2026:3649-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3649-1 advisory. - CVE-2025-15366: user-controlled command can allow additional commands injected using newlines bsc1257044. -...

CVE-2026-77113

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...

CVE-2026-77113

The apport-unpack utility in Canonical Apport (versions before 2.36.0, 2.34.2, and 2.28.4) is vulnerable to path traversal: attacker-controlled key names in crash report files allow creation or overwriting of arbitrary files with the privileges of the executing user. CVSS 6.7 (MEDIUM), local vect...

CVE-2026-77113 Path Traversal Vulnerability in apport-unpack

Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files...