Path traversal vulnerability in robot

robot 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the build directory on the Jenkins controller. This allows attackers with Item/Configure permission to create or replace arbitrary files on the Jenkins controller file...

CVE-2026-85731: Improper Limitation of a Pathname to a Restricted Directory

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true can write outside the store working directory. The pushDir path through extractTarDirectory and ensureLinkPath validates symlink targets...

SUSE SLED15: acl / attr / libacl-devel / libacl1 / libacl1-32bit / libattr-devel / etc (SUSE-SU-2026:4176-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4176-1 advisory. This update for acl, attr fixes the following issue: - CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink...

SUSE SLES15: libpython3_9-1_0 / python39 / python39-base / python39-curses / etc (SUSE-SU-2026:4174-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4174-1 advisory. Security issues fixed: - CVE-2026-0864: improper handling of line-ending characters can lead to configuration file injection when t...

PT-2026-93280

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

CVE-2026-92816: Improper Limitation of a Pathname to a Restricted Directory

ComfyUI before 0.30.0 fails to sanitize foldername input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output directory. Attackers can load a crafted workflow that writes attacker-controlled content to arbitrary locations, enabling code execution through...

CVE-2026-27557: Path Traversal: '.../...//'

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...

CVE-2026-76555: Improper Limitation of a Pathname to a Restricted Directory

The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessible directory, allowing any user whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import...

SUSE SLES12: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4179-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4179-1 advisory. - CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. - CVE-2026-20338: invalid free due to bad...

CVE-2026-76432: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level privileges to write arbitrary files on an affected device. This vulnerability exists because the affected software does not properly validat...

CVE-2026-92131: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Pipeline: Groovy Libraries Plugin 805.vafc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative path inside the SCM checkout, and follows symbolic links to locations outside of the SCM checkout when retrieving the library, resulting i...

SUSE SLED15: clamav / clamav-devel / clamav-docs-html / clamav-milter / etc (SUSE-SU-2026:4180-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4180-1 advisory. - CVE-2026-20337: Improper boundary checks for content in zip archive parser bsc1274597. - CVE-2026-20338:...

CVE-2026-92355: Improper Limitation of a Pathname to a Restricted Directory

In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, which in some configurations could lead to remote code execution...

PT-2026-93350

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view uploaded iodd file endpoint allowing the SSH server's private keys to be read...

CVE-2026-92604: Improper Limitation of a Pathname to a Restricted Directory

Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacker-controlled JSON content to filesystem paths. Attackers can supply path traversal sequences in the uploaded document's id field to escape...

CVE-2026-76431: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to delete arbitrary files and directories on an affected device. To exploit this vulnerability, the attacker must have valid...

CVE-2026-86071: Improper Limitation of a Pathname to a Restricted Directory

Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java can create directories outside the intended extraction root when processing a crafted archive entry. LocalFolderExtractor.createFile validat...

CVE-2026-92748: Improper Limitation of a Pathname to a Restricted Directory

BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbitrary paths on the C2 server. Attackers can use path traversal sequences in the filename to bypass directory containment and write malicio...

CVE-2026-63225: Improper Limitation of a Pathname to a Restricted Directory

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths under --outDir from untrusted OpenAPI or AsyncAPI component names and x-codeSamples lang values without verifying that the resolved target...

CVE-2026-40854: Authentication Bypass by Spoofing

WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechanism improperly validates the sessionid cookie by checking for the existence of a corresponding file in /tmp/loginuser. An attacker can bypass authentication b...