CVE-2026-84431

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.airasia.mobile. Performing a manipulation of the argument displayname results in path traversal. The attack requires a...

CVE-2026-84441

Piwigo versions up to 16.3.0 are affected by a path traversal vulnerability in the Image Derivative Handler component, specifically in the file i.php . The vulnerable functionality is described as unknown, but manipulation of it allows an unauthenticated remote attacker to traverse the filesystem...

EUVD-2026-69819

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84441 Piwigo Image Derivative i.php path traversal

A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of the component Image Derivative Handler. The manipulation leads to path traversal. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-84702

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84431 AirAsia MOVE App com.airasia.mobile com.airasia.core.utils.RealPathUtil.getRealPath path traversal

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.airasia.mobile. Performing a manipulation of the argument displayname results in path traversal. The attack requires a...

EUVD-2026-69795

A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUtil.getRealPath of the component com.airasia.mobile. Performing a manipulation of the argument displayname results in path traversal. The attack requires a...

CVE-2026-84431

A path traversal vulnerability exists in the AirAsia MOVE App (versions up to 12.47.1 on Android). The flaw resides in the function com.airasia.core.utils.RealPathUtil.getRealPath within the component com.airasia.mobile , where manipulation of the _display_name argument allows an attacker to trav...

CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

EUVD-2026-69793

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

CVE-2026-84702

facefusion through 3.6.1 is vulnerable to a path traversal flaw in the get_job_file_name function (located in facefusion/jobs/job_manager.py), which fails to normalize job identifiers. An attacker can supply traversal sequences in the job identifier parameter via the unauthenticated HTTP API to w...

CVE-2026-84702 facefusion before 3.7.0 Path Traversal via Job Identifier

facefusion through 3.6.1 fails to normalize job identifiers in getjobfilename, allowing attackers to write files outside the jobs directory. Attackers can supply traversal sequences in the job identifier parameter through the unauthenticated HTTP API to create files at arbitrary locations...

EUVD-2026-69720

WWBN AVideo contains a path traversal vulnerability in the API getapilogincode endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file...

Linux Distros Unpatched Vulnerability : CVE-2026-84373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Vitest is a testing framework powered by Vite. From 2.1.0 until 4.1.11 and 5.0.0-rc.2, the public mockerPlugin and standalone interceptorPlugin exports in...

MiracleLinux 8 : glib2-2.56.4-177.el8_10 (AXSA:2026-1730:14)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1730:14 advisory. glib: buffer over-read in glib/gvariant-serialiser.c via gvstupleisnormal CVE-2026-58010 glib: out-of-bounds read in glib/gdatetime.c:gdatetimegetym...

PT-2026-84733

Name of the Vulnerable Software and Affected Versions Kibana affected versions not specified Description A path traversal flaw exists in the Kibana Fleet feature. A low-privileged user with write access to Fleet Settings can manipulate pathnames to target restricted directories. This allows the...

CVE-2026-84478

WWBN AVideo contains a path traversal vulnerability in the API getapilogincode endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file...

Kibana 8.19.17, 9.3.6, 9.4.3 Security Update (ESA-2026-159)

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in Kibana Leading to Unauthorized Resource Deletion Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via...

Kibana 8.19.18, 9.3.6, 9.4.3 Security Update (ESA-2026-158)

Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Deletion of Privileged Resources Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of privileged...