EUVD-2026-58130

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

CVE-2026-67613 CyberPanel < 3.0.0 Path Traversal File Read via cloudAPI ReadReport

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

CVE-2026-67613

CyberPanel

CVE-2026-59196

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to manipulate the package installation process by using a specially crafted lockfile alias. This could lead to path traversal, enabling the attacker to write files outside the designated installation director...

CVE-2026-73505

creationtimestamp| type| source ---|---|--- 2026-08-13 16:35:07+00:00| published-proof-of-concept| https://github.com/JanDeDobbeleer/oh-my-posh/security/advisories/GHSA-6xj8-qv9j-xcjq...

CVE-2026-73509

creationtimestamp| type| source ---|---|--- 2026-08-13 16:35:02+00:00| published-proof-of-concept| https://github.com/OpenListTeam/OpenList/security/advisories/GHSA-95cv-r8x4-vh75...

CVE-2026-13048 Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language attribute into the catalog filename

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-13048

Data::MuForm::Localizer for Perl (through v0.05) is vulnerable. load_lexicon constructs catalog paths using Messages/$lang.po without validating bare locale tags, enabling ../ path traversal and loading of arbitrary .po files. While parsing, the code evaluates header-derived content (Plural-Forms...

EUVD-2026-58117

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because loadlexicon interpolates the language attribute into the catalog filename. loadlexicon builds the catalog path by appending Messages/$lang.po to the directory...

CVE-2026-73573

In Zimbra Collaboration ZCS before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence,...

webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information

A flaw was found in WebKitGTK. Processing maliciously crafted web content can disclose sensitive user information due to a path handling issue that was addressed with improved validation...

CVE-2026-73574

In Zimbra Collaboration before 10.1.17, a local file inclusion LFI vulnerability exists in the Zimbra Classic Web Client due to improper validation of the fu request parameter. An unauthenticated attacker can exploit this vulnerability by supplying a crafted path, potentially allowing unauthorize...

EUVD-2026-58072

In Zimbra Collaboration ZCS before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence,...

CVE-2026-73573

A path traversal vulnerability in Zimbra Collaboration (ZCS) before 10.1.17 affects the Briefcase document editing functionality, where the packages parameter is not properly validated. An authenticated attacker can supply a crafted path traversal sequence to disclose sensitive files within the w...

CVE-2026-73573

In Zimbra Collaboration ZCS before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence,...

CVE-2026-73573

In Zimbra Collaboration ZCS before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence,...

CVE-2026-73573

In Zimbra Collaboration ZCS before 10.1.17, a path traversal vulnerability exists in the Zimbra Briefcase document editing functionality due to improper validation of the packages parameter. An authenticated attacker can exploit this vulnerability by supplying a crafted path traversal sequence,...

CVE-2026-73509

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batchrename handler in server/handles/fsbatch.go authorizes only the source directory produced by user.JoinPathreq.SrcDir and validates renameObject.NewName with checkRelativePath, but does not...

CVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or w...