CVE-2026-76409

Cisco Nexus Dashboard is affected by an improper limitation of a pathname vulnerability (CWE-22), discovered during an internal security review and addressed in a software hardening release published in September 2026. The vulnerability is rated CVSS 3.1: 8.8 (HIGH) , with a vector of AV:N/AC:L/P...

CVE-2025-10897

CVE-2025-10897 WooCommerce は、WordPress サイトをオンラインストアに変えるオープンソースの eコマースプラグインです。WooCommerce Designer Pro は、JMA Plugins が開発した WordPress プラグインで、顧客が WooCommerce ストア上で直接製品をデザイン・カスタマイズできるようにします。 重要 : WooCommerce と WooCommerce Designer Pro はまったく異なります。 WooCommerce Designer Pro...

TVT NVMS 1000 - Local File Inclusion

TVT NVMS-1000 devices allow GET /.. local file inclusion attacks. id: CVE-2019-20085 info: name: TVT NVMS 1000 - Local File Inclusion author: daffainfo severity: high description: | TVT NVMS-1000 devices allow GET /.. local file inclusion attacks. impact: | An attacker can exploit this...

CVE-2026-22557

🛡️ CVE-2026-22557 - Ubiquiti UniFi Network Application における重大なパストラバーサル脆弱性 📋 概要 Ubiquiti UniFi Network Application （UniFi Controller）に、認証不要の重大なパストラバーサル脆弱性 （CWE-22）が存在します。 ネットワークアクセス を持つ攻撃者は、この欠陥を悪用して以下が可能です： ../ によるディレクトリ境界の横断 基盤となるオペレーティングシステム上の任意のファイルを読み取り・操作 システムアカウントへの不正アクセスを獲得し、完全な侵害に至る可能性...

CVE-2026-0847

CVE-2026-0847 — NLTK の複数の CorpusReader クラス: パストラバーサルによる任意ファイル読み取り -orange?style=for-the-badge 概要...

CVE-2025-5880-PoC

CVE-2025-5880 — Whistle 2.9.98 パストラバーサル PoC Whistle v2.9.98 における未認証のパストラバーサル脆弱性の実証コード。 脆弱性の概要...

CVE-2024-46987

CVE-2024-46987 – Camaleon CMS の認証済みパストラバーサル / 任意ファイル読み取り CVE-2024-46987 は、Camaleon CMS （Ruby on Rails ベースのコンテンツ管理システム）における認証済みパストラバーサル脆弱性 （CWE-22）です。これにより、ログイン済みユーザー（低権限でも）が MediaControllerdownloadprivatefile アクションを介してサーバー上の任意のファイルを読み取ることができます。 公開日 : 2024年9月18日 CVSS v3.1 : 7.7 High ベクター:...

CVE-2025-66249-POC

CVE-2025-66249 — Apache Livy 路径遍历白名单绕过 仅供教育和安全研究使用。请勿对您不拥有或未获明确书面许可的系统进行测试。→完整免责声明 概述 字段| 详情 ---|--- CVE ID| CVE-2025-66249 严重性| 重要（CVSS 不适用 — 截至 2026-03-15，NVD 评估待定） 影响版本| Apache Livy 0.3.0-incubating 至 0.8.0-incubating — 仅当livy.file.local-dir-whitelist 设置为非默认值时 修复版本| Apache Livy 0.9.0-incubatin...

CVE-2026-77110 Adobe Commerce | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Adobe Commerce is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in a Security feature bypass. An attacker with high privileges could leverage this vulnerability to access unauthorized files or directories outside the...

ConnectWise ScreenConnect <= 23.9.7 - Path Traversal

ConnectWise ScreenConnect 23.9.7 and prior contain a path traversal caused by improper handling of user input, letting attackers execute remote code or access confidential data, exploit requires network access. id: CVE-2024-1708 info: name: ConnectWise ScreenConnect = 23.9.7 - Path Traversal...

CVE-2026-78599

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

CVE-2026-78591 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

CVE-2026-78590 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet Settings write access could cause a subsequent...

EUVD-2026-70060

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of internal resources via Path Traversal CAPEC-126. A low-privileged user holding Fleet write access could cause a subsequent administrative delete...

EUVD-2026-70055

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Elastic Maps Server can lead to information disclosure via Path Traversal CAPEC-126. An unauthenticated attacker able to reach the service over the network could cause it to return the contents of files outside...

Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged...

CVE-2026-78592

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

CVE-2026-78592 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in Kibana can lead to the unauthorized deletion of privileged resources via Path Traversal CAPEC-126. A low-privileged user holding tag creation privileges could cause a subsequent administrative action in the tag...

PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks

Summary PraisonAI's praisonai.code tool wrappers exported as CODETOOLS for agents expose a workspace setting that the module itself treats as a path-traversal security boundary — readfile, writefile, applydiff, and searchreplace explicitly call ispathwithindirectory and return "… is outside the...