PT-2026-111407

Name of the Vulnerable Software and Affected Versions SeldonIO MLServer versions prior to 1.6.2 Description A remote path traversal issue exists within the environment tarball Handler. The flaw is located in the extract env function of the mlserver/env.py file, allowing an attacker to manipulate...

PT-2026-111406

A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation causes path traversal. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not...

PT-2026-111405

Name of the Vulnerable Software and Affected Versions MosaicML Composer versions prior to 0.32.2 Description A path traversal issue exists in the Checkpoint Extraction component within the tarball.extractall function of the composer/utils/checkpoint.py file. This flaw allows a remote attacker to...

PT-2026-111683

A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files...

PT-2026-111671

A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system...

PT-2026-111550

Name of the Vulnerable Software and Affected Versions Hono versions 4.12.4 through 4.13.10 Description A middleware bypass exists in the serveStatic function. Unauthenticated attackers can bypass prefix middleware by using double path decoding, sending malformed percent-encoded paths that the...

PT-2026-111591

HyperScale contained a path traversal issue affecting information disclosure. Software customers upgrade to resolved maintenance release. Update Commvault installation of HyperScale MediaAgents...

PT-2026-111570

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.1.1 through 4.14.7 Description A path traversal issue exists in the upload list file, upload rule file, and upload decoder file functions. Attackers possessing the cluster key can send DistributedAPI requests containing ../...

PT-2026-111574

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get list file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read...

PT-2026-111708

Risesoft-y9 Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager storeFile endpoint that allows unauthenticated attackers to write arbitrary files. Attackers can send crafted fullPath and fileName parameters to POST /rest/storeFile to create or...

CVE-2026-107615

An uncontrolled search path element vulnerability in GlavSoft TightVNC Server for Windows before 2.8.88 allows a local authenticated user to execute arbitrary code with SYSTEM privileges. DynamicLibrary::init and ThemeLib load screenhooks32.dll / screenhooks64.dll with LoadLibrary using a bare fi...

PT-2026-112000

Improper limitation of a pathname to a restricted directory 'path traversal' in Dynamics Business Central allows an authorized attacker to elevate privileges over a network...

PT-2026-112025

Name of the Vulnerable Software and Affected Versions Windows SmartScreen affected versions not specified Description Improper resolution of path equivalence allows an unauthorized attacker to bypass a security feature over a network. Recommendations At the moment, there is no information about a...

PT-2026-111858

MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting fil...

PT-2026-111854

muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination folder by bypassing its ZipSlip check with unnormalized remote paths. Attackers can craft TAR or ZIP entries like ../../.ssh/authorized keys that, when...

PT-2026-111938

Name of the Vulnerable Software and Affected Versions Visual Studio Code versions prior to 1.141.1 Description An issue exists where improper limitation of a pathname to a restricted directory, known as path traversal, allows an unauthorized attacker to execute code over a network. Path traversal...

PT-2026-111930

🚨 CVE-2026-102226 Improper limitation of a pathname to a restricted directory 'path traversal' in Dynamics Business Central allows an authorized attacker to elevate privileges over a network. 🎖@cveNotify...

PT-2026-111925

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network. WebDAV is an extension of the HTTP protoco...

PT-2026-113529

CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended...

PT-2026-111836

Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...