54888 matches found
PT-2026-70877
electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious FTP or SFTP server to write attacker-controlled content outside the selected download directory because recursive transfers in...
PT-2026-70888
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete revision function in all versions up to, and including, 2.8.169. This makes it possible for...
PT-2026-70269
Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product subscriptions. From 0.1.135, to 0.1.168, platform API keys issued to tenants are exchanged for upstream requests made with shared provider accounts ChatGPT/Codex OAuth, OpenAI platform keys, or an...
Gaudi Container Runtime Software Advisory
Summary: A potential security vulnerability for some Gaudi Container Runtime software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2026-32677 Description: Path traversal for some...
Zoom Workplace VDI Client < 7.0.11 Vulnerability (ZSB-26018)
The version of Zoom Workplace VDI Client installed on the remote host is prior to 7.0.11. It is, therefore, affected by a vulnerability as referenced in the ZSB-26018 advisory. - Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via...
PT-2026-70384
CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...
Debian dsa-6429 : caddy - security update
The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6429 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/securit...
CVE-2026-68083
A flaw was found in ksmbd, a Linux kernel module that provides an in-kernel SMB server. An authenticated client could exploit a path resolution error, specifically in the ksmbdvfskernpathcreate function. This vulnerability allows a client to use ".." components in a path to escape the intended...
Directory Traversal
Overview unearth is an A utility to fetch and download python packages Affected versions of this package are vulnerable to Directory Traversal through the iswithindirectory check in untararchive and iswithindirectory in unearth’s tar extraction code. An attacker can write files outside the intend...
DEBIAN-CVE-2026-73030
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...
CVE-2026-73033
Sucuri Security WordPress plugin through version 2.7.3 contains a path traversal vulnerability in the pageIntegritySubmission method in src/integrity.lib.php that allows authenticated administrators to delete arbitrary files by supplying directory traversal sequences in the sucuriscanintegrity...
CVE-2026-73030
unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before validation, allowing ../ sequences to bypass directory containment checks. Attackers can supply malicious tar archives with symlink membe...
CVE-2026-72903
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir and makeFile use POSIX path processing that preserves the backslashes a...
GHSA-55Q2-FJHQ-7XH7 vulnerabilities
Vulnerabilities for packages: langfuse, nextcloud-server...
CVE-2026-72903
Tabby (formerly Terminus) has a Windows path traversal issue tracked as CVE-2026-72903. In affected builds prior to 1.0.235, the SFTP flow preserves backslashes and relative traversal when handling filenames returned by a malicious SFTP server. Specifically, SFTPSession.readdir() and _makeFile() ...
CVE-2026-72903 Tabby: Windows SFTP path traversal allows a malicious server to write files outside the selected download directory
Tabby formerly Terminus is a highly configurable terminal emulator. Prior to 1.0.235, a malicious SFTP server can return a backslash traversal filename through entry.name. In tabby-ssh/src/session/sftp.ts, SFTPSession.readdir and makeFile use POSIX path processing that preserves the backslashes a...
CVE-2026-54572 vulnerabilities
Vulnerabilities for packages: telegraf...
GHSA-CF44-9PGV-M4XC vulnerabilities
Vulnerabilities for packages: telegraf...