The vulnerability of the ImageMedium::watermark() function in the Grav CMS system allows a hacker to disclose protected information.

The vulnerability of the ImageMedium::watermark function in the Grav CMS system is related to an incorrect limitation on the path to the catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

The vulnerability of the YARD documentation generation and hosting tool, written in the Ruby programming language, arises from an incorrect limitation on the path to the directory. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the YARD tool for generating and hosting documentation in the Ruby programming language is related to an incorrect limitation on the path to the directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the authd and remoted processes of the monitoring and threat detection platform Wazuh allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the registration demon authd and the synchronization demon remoted of the Wazuh platform for security monitoring and threat detection is related to an incorrect restriction on the path name to the catalog. Exploiting this vulnerability could allow a malicious actor to gain...

ROS-20260709-73-0034

The vulnerability in python-pip relates to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

The vulnerability of the SAP Fiori business application deployment panel allows a hacker to gain unauthorized access to the user account.

The vulnerability of the SAP Fiori business application design platform’s startup panel is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to the user account...

The vulnerability of the ColdFusion interpreter lies in the incorrect limitation of the path name to the restricted access catalog, allowing attackers to bypass existing security restrictions.

The vulnerability of the ColdFusion interpreter is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability allows an attacker to bypass existing security restrictions remotely...

ROS-20260526-73-0017

Vulnerability in poetry related to incorrect path name restriction to a restricted directory. Exploitation of the vulnerability may allow a remote intruder to gain unauthorized access to protected information...

The vulnerability of the cpdavd control panel for web hosting, including cPanel and WordPress Squared, as well as the WebHost Manager administrative panel, allows a hacker to read arbitrary files.

The vulnerability of the cpdavd control panel in web hosting using cPanel and WordPress Squared, as well as the WebHost Manager administration panel, is related to incorrect path name restrictions for restricted access directories. Exploiting this vulnerability could allow a malicious actor to re...

The vulnerability of the Java-based web application framework Apache Wicket relates to incorrect path name restrictions for restricted directories. This allows attackers to read arbitrary files.

The vulnerability of the Java-based web application framework Apache Wicket relates to an incorrect path name limitation for the restricted access directory. Exploiting this vulnerability could allow a malicious actor to read arbitrary files...

The vulnerability of the decompress_files() function on the platform for security monitoring and threat detection by Wazuh allows a perpetrator to execute arbitrary code.

The vulnerability of the decompressfiles function on the Wazuh security monitoring and threat detection platform is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

The vulnerability of the Cisco Identity Services Engine (ISE) policy management platform, related to an incorrect limitation on the path name to the restricted access catalog, allows a perpetrator to execute arbitrary code.

The vulnerability of the Cisco Identity Services Engine ISE platform relates to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the graphical user interface of the FortiSandbox threat detection and mitigation system allows a violator to delete any arbitrary directory.

The vulnerability of the graphical user interface of the FortiSandbox threat detection and mitigation system is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to delete any directory by sending speciall...

The vulnerability in the web-based tool for centralized control and configuration of QLogic adapters in the Marvell QConvergeConsole system exists due to an incorrect limitation on the path name to the restricted access catalog. This vulnerability allows attackers to disclose sensitive information that is protected by this system.

The vulnerability of the web-based tool for centralized control and configuration of QLogic adapters in the Marvell QConvergeConsole is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to disclose...

The vulnerability of the downloadToDir() function in the FTP-client library of the Node.js software platform, which allows a hacker to execute arbitrary code.

The vulnerability of the downloadToDir function in the FTP-client library of the Node.js software platform is related to an incorrect limitation on the path to the restricted directory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

ROS-20260331-73-0001

A vulnerability in the Wheel file manipulation command line tool is related to an incorrect directory path name restriction. Exploitation of the vulnerability could allow an attacker to escalate privileges or execute arbitrary code...

The vulnerability of the Spring Cloud Config server, related to incorrect path name restrictions for the directory, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Spring Cloud Config server is related to an incorrect restriction on the path to the catalog. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information by sending a specially crafted request...

The vulnerability of the diag_command.php component of the Netgate pfSense software, which allows a hacker to read arbitrary files.

The vulnerability of the diagcommand.php component of the Netgate pfSense software firewall is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a remote attacker to read arbitrary files...

The vulnerability in the virtualization subsystem’s arch/x86/kvm/mmu.c module on the Linux operating system’s x86 kernel allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability in the arch/x86/kvm/mmu.c module of the virtualization subsystem on the Linux kernel-based x86 platform is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality,...

Advisory ROSA-SA-2026-3186

Software: vim 8.0.1763 OS: ROSA Virtualization 3.0 unaffected versions = vim-8.0.1763-21.0.1.1.rv30 affected versions vim-8.0.1763-21.0.0.1.rv30 CVE-ID: CVE-2025-53905 BDU-ID: 2025-11730 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the vim text editor is related to an incorrect restriction of t...

The vulnerability of Vivotek IP7137 micro-programmed IP cameras arises from incorrect restrictions on the path name to the restricted access directory. This allows intruders to gain unauthorized access to protected information.

The vulnerability of Vivotek IP7137 micro-programmed software cameras is related to incorrect restrictions on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...