CVE-2020-17518

Apache Flink directory traversal vulnerability, allows remote file read/write via REST API Vulnerability ID: CVE-2020-17518 Vulnerability Description: CVE-2020-17518: Write remote files via REST API Affected Versions: Flink 1.5.1-1.11.2 Safe Versions: Flink 1.11.3 or Flink 1.12.0 Flink 1.5.1...

CVE-2013-6987

CVE-2013-6987 Multiple directory traversal vulnerabilities in the FileBrowser components in Synology DiskStation Manager DSM before 4.3-3810 Update 3 allow remote attackers to read, write, and delete arbitrary files via a .. dot dot Usage: python example: list filesystem python filelist.py...

CVE-2026-68950

The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable...

EUVD-2026-79947

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable...

PT-2026-93118

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The software contains hard-coded credentials. This flaw allows remote access to files with root privileges on systems where the FTP service is reachable...

Astra Linux – Vulnerability in Chromium

Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-14602

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...

EUVD-2025-210746

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...

CVE-2025-14602 Weak File Name Generation in vsDesk

The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, whic...

Exploit for Path Traversal in Apache Http_Server

No d...

EUVD-2026-61140

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection...

CVE-2026-71880

GBIF Integrated Publishing Toolkit (versions before 3.3.4) has a server-side template injection vulnerability in its template engine. Remote authenticated attackers with low privileges can inject untrusted input into templates, achieving high confidentiality and integrity impact (CVSS 7.6) by rea...

GO-2026-4509 vulnerabilities

Vulnerabilities for packages: nuclei...

CVE-2026-69109

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

MAL-2026-13615 Malicious code in agenthub-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f29f622134cd387e49d4293fb004554b677e44f972187d6798d6c885a3aa5b0 The package runs as a persistent daemon that opens a WebSocket to the hardcoded production endpoint wss://agenthub-agent.fyenet.com and dispatches...

Malicious code in @xiaohhhh1/canvas-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a34add291ef7584aec7041449cb2e80d36ae98f93c2725e1aa018707e3334119 On bin start, @xiaohhhh1/canvas-agent opens an outbound WebSocket to the hardcoded relay wss://canvas.xiaohhhh1.com/api/agent-relay and treats inboun...

PT-2026-68328

Name of the Vulnerable Software and Affected Versions rclone versions 1.40.0 through 1.74.0 Description The serve restic command fails to properly reject URL paths starting with ../ in the WithRemote function within cmd/serve/restic/restic.go. This allows a leading parent path to be passed to GET...

PT-2026-66884

The vulnerability allows remote attackers to read arbitrary files on the server by exploiting improper path validation in the livereload server functionality. This vulnerability is related to the handling of file paths in the livereload server component, which could allow an attacker to traverse...

CVE-2026-12942 Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...

CVE-2026-12942 Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints

IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences /.. / to view arbitrary files on the system...