CVE-2026-93616 Directory Traversal and File upload allows execution of arbitrary script on the Management Server

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

CVE-2026-93616

A pre-authentication directory traversal vulnerability exists in the Check Point Management Web Service , affecting Check Point Security Management and Log Servers. This flaw allows unauthenticated attackers to upload and execute arbitrary scripts, potentially leading to remote code execution . A...

EUVD-2026-84375

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

CVE-2026-93616 Directory Traversal and File upload allows execution of arbitrary script on the Management Server

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

CVE-2026-15095

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

EUVD-2026-84334

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-15095 Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-15095 Product Feed Manager for WooCommerce <= 6.6.43 - Authenticated (Shop Manager+) Path Traversal to File Deletion via 'provider' Parameter

The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.6.43 via the 'provider' parameter. This makes it possible for authenticated attackers, with shop...

CVE-2026-15095

The Product Feed Manager for WooCommerce – CTX Feed plugin for WordPress is vulnerable to directory traversal in all versions up to and including 6.6.43 via the provider parameter. Authenticated attackers with Shop Manager or higher privileges can delete arbitrary files on the server by issuing t...

CVE-2025-1280

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

CVE-2025-1280

BM Content Builder is a WordPress plugin affected by a Directory Traversal vulnerability in the ux_cb_page_customize_save_layout_ajax() function. All versions prior to 3.17.1 are impacted, allowing authenticated attackers with Subscriber-level privileges or higher to read arbitrary files on the s...

CVE-2025-1280 BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

EUVD-2025-210985

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

CVE-2025-1280 BM Content Builder < 3.17.1 - Authenticated (Subscriber+) Arbitrary File Read

The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 exclusive via the uxcbpagecustomizesavelayoutajax function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary...

CLEANSTART-2026-AL86944 Previously, resolving relative paths containing parent directory ('

CVE-2026-56860 affects multiple packages. Previously, resolving relative paths containing parent directory '. See references for individual vulnerability details...

PT-2026-96683

Name of the Vulnerable Software and Affected Versions Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping & Social Channels versions prior to 6.6.44 Description A Directory Traversal issue exists where authenticated attackers with shop manager-level access or higher can delete...

CVE-2026-88624

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

CVE-2026-88624

The openCode software (version v1.18.26 ) is vulnerable to a security flaw due to missing path validation in the Worktree.remove component. An attacker can exploit this by providing a crafted payload to perform arbitrary recursive directory deletion . The vulnerability carries a CRITICAL severity...

CVE-2026-88624: Improper Limitation of a Pathname to a Restricted Directory

Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory deletion via a crafted payload...

PT-2026-97034

Name of the Vulnerable Software and Affected Versions openCode version 1.18.26 Description Missing path validation in the Worktree.remove component allows attackers to perform arbitrary recursive directory deletion using a crafted payload. This issue is a path traversal flaw, which occurs when an...