CVE-2023-22631

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

PT-2026-91168

Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder Free and Pro 4.0.0 - 6.9.0 - The folder request parameter replaced the generated date-based destination folder in its entirety and was then passed to Folder::create and File::upload without either...

EUVD-2023-60633

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

CVE-2023-22631

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

CVE-2023-22631

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

CVE-2023-22631: Improper Neutralization of Argument Delimiters in a Command

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

PT-2026-91035

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor...

PT-2026-91401

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 7.24.2 Description A path traversal issue exists in the container package OCI/tar image extraction. This allows attackers to write files outside the container root by providing a crafted container image...

CVE-2023-22632

PRTG Network Monitor (Paessler) before version 23.1.82 is affected by a vulnerability that allows remote attackers to write to files via the FTP Server Count Sensor . The attack requires high privileges (authenticated access) over the network, resulting in a low integrity impact (CVSS 3.1 score 2...

PT-2026-91452

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2023-22632

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

CVE-2026-16338: External Control of File Name or Path

IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to perform an arbitrary file write due to improper validation of file paths...

CVE-2023-22632

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

PT-2026-91758

Name of the Vulnerable Software and Affected Versions DevSpace versions prior to 6.3.22 Description The software fails to reject parent-directory segments in tar entry names originating from the in-pod sync stream. This allows an attacker operating a malicious container to stream tar entries...

CVE-2023-22632: Improper Neutralization of Argument Delimiters in a Command

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor...

CVE-2026-56839: Improper Limitation of a Pathname to a Restricted Directory

PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODETOOLS wrappers keep workspaceroot as None and pass workspace=None to readfile, searchreplace, and applydiff helpers that enforce path containment only for a truthy workspace. An application that exposes codereadfile,...

PT-2026-91398

Name of the Vulnerable Software and Affected Versions PyMuPDF versions prior to 1.28.3 Description A path traversal issue exists in the extract objects function within src/ main .py. The software constructs output filenames by joining a document-controlled BaseFont name to a user-supplied output...

CVE-2026-82035: Improper Limitation of a Pathname to a Restricted Directory

PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extractobjects in src/main.py, where the output filename is constructed by joining a document-controlled BaseFont name directly onto the user-supplied output directory without stripping...

PT-2026-91199

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to other locations on disk...

CVE-2026-91200: Improper Limitation of a Pathname to a Restricted Directory

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution...