CVE-2026-70383

A flaw was found in the DigiDoc4 client. This vulnerability, categorized as an Improper Limitation of a Pathname to a Restricted Directory Path Traversal, allows a local attacker to write files to arbitrary locations on the system with active user interaction. By exploiting this flaw, an attacker...

The vulnerability of the Kerberos protocol for Windows operating systems allows attackers to increase their privileges.

The vulnerability of the Kerberos protocol for Windows operating systems is related to errors in the mechanism for handling relative pathnames to the directory. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

nginx-log-analyzer

nginxloganalyzer Nginx Access Log Security Analysis Tool —...

CVE-2026-10053 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

ids-traffic-analysis

Network Intrusion Detection and Traffic Analysis Platform Thi...

Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

MAL-2026-14370 Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

MAL-2026-14378 Malicious code in stillm4ddpocs-rtest-bravo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e4272ba48bc8a81c8a76e7948aed6974b40956c151f05a613456e92690f5f2 package.json declares scripts.preinstall = 'node index.js', so npm install auto-executes index.js. The script collects hostname, username, home...

Malicious code in stillm4ddpocs-rtest-bravo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15e4272ba48bc8a81c8a76e7948aed6974b40956c151f05a613456e92690f5f2 package.json declares scripts.preinstall = 'node index.js', so npm install auto-executes index.js. The script collects hostname, username, home...

Malicious code in stillm4ddpocs-demo-sprocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced86462ad99b91f0f3e3d344e008ca911a1dccdad5c928cee5da5c651756f1d package.json declares scripts.preinstall = 'node index.js'. On install, index.js collects hostname, username, home directory, cwd, local IPv4, public...

MAL-2026-14376 Malicious code in stillm4ddpocs-demo-sprocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ced86462ad99b91f0f3e3d344e008ca911a1dccdad5c928cee5da5c651756f1d package.json declares scripts.preinstall = 'node index.js'. On install, index.js collects hostname, username, home directory, cwd, local IPv4, public...

Malicious code in stillm4ddpocs-rtest-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47545f800dcb07213863afb8beab283755fb596ea7d5d478b60e4ff449453839 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's local IPv4, public IP via...

MAL-2026-14377 Malicious code in stillm4ddpocs-rtest-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47545f800dcb07213863afb8beab283755fb596ea7d5d478b60e4ff449453839 package.json declares a preinstall hook that runs index.js on npm install. index.js collects the installer's local IPv4, public IP via...

SiYuan <= v3.6.1 - Path Traversal

SiYuan is a personal knowledge management system. Prior to version 3.6.2, the Siyuan kernel exposes an unauthenticated file-serving endpoint under /appearance/filepath. Due to improper path sanitization, attackers can perform directory traversal and read arbitrary files accessible to the server...

WordPress ARMember Premium <= 7.3.1 - Unauthenticated SQL Injection

The ARMember Premium plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'armdirectorypagingaction' AJAX action in all versions up to, and including, 7.3.1. This is due to insufficient escaping on the user-supplied 'order' and 'orderby' parameters and the lack of...

Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal

Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication. id: CVE-2017-9965 info: name: Schneider Electric Pelco VideoXpert...

Elasticsearch - Local File Inclusion

Elasticsearch before 1.4.5 and 1.5.x before 1.5.2 allows remote attackers to read arbitrary files via unspecified vectors when a site plugin is enabled. id: CVE-2015-3337 info: name: Elasticsearch - Local File Inclusion author: pdteam severity: medium description: Elasticsearch before 1.4.5 and...

Geddy <13.0.8 - Local File Inclusion

Geddy prior to version 13.0.8 contains a directory traversal vulnerability in lib/app/index.js that allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the PATHINFO to the default URI. id: CVE-2015-5688 info: name: Geddy 13.0.8 - Local File Inclusion author:...

Koha 3.20.1 - Directory Traversal

Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the templatepath parameter to 1 svc/virtualshelves/search or 2 svc/members/search. id: CVE-2015-4632 info: name:...

WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal

A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the dewfile parameter. id: CVE-2013-7240 info: name: WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal author...