144022 matches found
CentOS Linux 7 [TuxCare] Security Update: rsync Multiple Vulnerabilities (CENTOS7:CLSA-2026:1789749013)
The CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1789749013 advisory. - rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands...
CVE-2024-58388: Improper Limitation of a Pathname to a Restricted Directory
Sharp and Toshiba Tec rebranded multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote attackers to read arbitrary files by manipulating the path parameter in the installedemanualdown.html endpoint. Attackers can supply directory traversal sequence...
PT-2026-103788
Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the Supabase node where the tableId parameter is inserted into request paths without proper validation. This allo...
PT-2026-103759
MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...
PT-2026-105583
KubeEdge: keadm DecompressTarGz path traversal enables arbitrary file write on Windows during edge node join in github.com/kubeedge/kubeedge...
PT-2026-105805
Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...
PT-2026-104012
Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.3 PackBot Teledyne FLIR Aware2 versions prior to 1.7.10 FirstLook Description Unvalidated pathnames in the web interface allow remote unauthenticated attackers to perform path traversal, a technique...
Fortinet FortiMail Path Traversal Vulnerability
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests...
ROS-20261001-73-0020
The vulnerability in Go-Git relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...
CVE-2026-51883
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...
CVE-2025-71427: Improper Limitation of a Pathname to a Restricted Directory
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse savepresentation,...
CVE-2026-103664: Improper Neutralization of Input During Web Page Generation
MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...
ROS-20261001-73-0023
The vulnerability in glib2 relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
CVE-2026-103255: External Control of File Name or Path
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase node where the tableId parameter is inserted into request paths without validation. Attackers can exploit workflows binding tableId to untrusted input to...
CVE-2026-71453: External Control of File Name or Path
External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63...
PT-2026-104054
Name of the Vulnerable Software and Affected Versions Office-PowerPoint-MCP-Server versions prior to 2.0.8 Description A path traversal issue allows callers to read and write files outside the intended working directory by using absolute paths or ../ sequences. An attacker can use prompt injectio...
ROS-20261001-73-0021
The vulnerability in rclone relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
VulnCheck KEV: CVE-2025-11913
A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this vulnerability is the function Download of the file /Service.do?Action=Download. Such manipulation of the argument Path leads to path traversal. The attack can be launched remotely. The exploit h...
VulnCheck KEV: CVE-2026-104286
Fortinet FortiMail contains a path traversal and an improper neutralization of NULL byte or NULL character vulnerability that may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests...
PT-2026-103912
Name of the Vulnerable Software and Affected Versions Prime Mover plugin for WordPress versions prior to 2.2.1 Description Authenticated administrators can delete arbitrary directories by importing a specially crafted WPRIME/TAR package. The issue stems from insufficient path validation within th...