CVE-2025-56499

CVE-2025-56499 Arbitrary File Read via Missing Path Validation in Local Rule Provider Upstream Fix: https://github.com/MetaCubeX/mihomo/pull/2177 Affected Versions: mihomo = v1.19.11 Summary When parsing rule-providers configuration, the type = "file" branch fails to validate the supplied path. A...

CVE-2025-52691

CVE-2025-52691 SmarterMail Unauthenticated Arbitrary File Upload RCE Overview Critical unauthenticated arbitrary file upload allowing remote code execution. Field| Value ---|--- Product| SmarterMail Affected| Build 9406 and earlier CVSS| 10.0 Critical Type| Arbitrary File Upload Vector| HTTP...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 testing environment and Nuclei template This repository contains a high-confidence Nuclei template to detect CVE-2021-21980 vSphere Web Client path traversal and a small mock environment that reproduces the vulnerable behavior for safe local testing. Files:...

EUVD-2026-94120

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

CVE-2026-97671 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability...

CVE-2026-97671

IBM Langflow OSS versions 1.0.0 through 1.12.2 are susceptible to a path traversal vulnerability (CWE-22 ). This flaw could allow a remote authenticated attacker to obtain sensitive information . No specific exploit details, impacts beyond information disclosure, or remediation steps are provided...

PT-2026-107480

Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successfu...

PT-2026-107500

A path traversal vulnerability exists in the unzip http RemoteZipFile extract functionality of VisiData versions: dev commit 38b21f78. A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability...

CVE-2026-101886: Improper Limitation of a Pathname to a Restricted Directory

Cisco Jabber for Android com.cisco.im before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized displ...

CVE-2026-105840

lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz...

Linux Distros Unpatched Vulnerability : CVE-2026-105840

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files...

PT-2026-107429

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the UR...

PT-2026-107328

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.12.2 Description A path traversal issue allows a remote authenticated attacker to access and obtain sensitive information. Path traversal is a flaw that allows an attacker to access files and directori...

PT-2026-107395

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and...

PT-2026-107581

Cisco Jabber for Android com.cisco.im before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized displ...

PT-2026-107501

A path traversal vulnerability exists in the EmailSheet extract parts functionality of VisiData versions: dev commit 38b21f78. A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability...

PT-2026-107511

Update: Since the original post, 20 additional Langflow CVEs have been published, including several high- and critical-severity vulnerabilities affecting versions up to 1.12.2. The newly disclosed issues cover a range of impact areas, including remote code execution, command injection,...

PT-2026-107433

Path traversal of 'trusted jar paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted jar paths'. The startup flag 'trusted jar paths' references URIs for loading files from local or remote filesystems. Path...

CVE-2026-106186

Uncontrolled search path element in CredentialProvider in Google Chrom...

PT-2026-107570

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs pfcp xact local create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The...