144018 matches found
CVE-2026-51875: Improper Limitation of a Pathname to a Restricted Directory
In Devika v1.0, the Feature Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server...
CVE-2026-103254: Improper Limitation of a Pathname to a Restricted Directory
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...
CVE-2026-103290: Path Traversal: '.../...//'
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...
CVE-2026-76147: Missing Authorization
A path traversal ZIP Slip vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code...
CVE-2026-14995: Improper Neutralization of Input During Web Page Generation
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-78249: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the web management interface of multiple Multifunction Devices and Printers, including Apeos C4571 1.1.3 and earlier, Apeos C3567 1.1.3, or other products listed, specifically in the handling of externally supplied parameters. If the device receives a...
CVE-2025-41753: Improper Limitation of a Pathname to a Restricted Directory
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...
PT-2026-105172
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The trace consumer constructs the output path as filename:joinTraceDir, Name ++ ".log" where Name comes from PUT /api/traces/:vhost/:name. No safe relative path / traversal check is applied ...
PT-2026-105887
Impact The Classic portlet plone.app.portlets.portlets.classic used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet...
CVE-2026-51880
deeptutor 1.4.0 contains a path traversal issue in EditFileTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the tool layer to write or edit absolute paths outside the intended bot workspace...
CVE-2026-103533: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...
PT-2026-105841
Summary Missing path validation in confluence upload attachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call. --- Details...
Apache HTTPD: CVE-2026-79768: Path Equivalence: '/./' (Single Dot Directory)
Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...
CVE-2026-103257: Improper Limitation of a Pathname to a Restricted Directory
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node that fails to validate resource identifiers. Attackers can craft malicious resource IDs to redirect API calls to unintended resources, allowing unauthorized...
PT-2026-104060
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...
CVE-2026-51883: Improper Limitation of a Pathname to a Restricted Directory
The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...
PT-2026-103711
Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2025-41753 Vendor → Unknown Severity → Critical — CVSS 9.3 Product → Unknown Date → 2026-10-01 A critical vulnerability Path Traversal has been disclosed affecting Unknown. Patch immediately...
CVE-2026-51884
The /knowledgebase/uploadtempdocs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory...
CVE-2026-51875
In Devika v1.0, the Feature Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server...