CVE-2026-83506: Untrusted Search Path

Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally...

CVE-2026-83683: Absolute Path Traversal

Absolute path traversal in Windows Encrypting File System EFS allows an authorized attacker to disclose information over a network...

CVE-2026-74031: Improper Limitation of a Pathname to a Restricted Directory

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the deleterulefile and deletedecoderfile helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through...

CVE-2026-74033: Improper Limitation of a Pathname to a Restricted Directory

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlists and deletelistfile CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path,...

CVE-2026-74043: Improper Limitation of a Pathname to a Restricted Directory

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...

CVE-2026-70142: Untrusted Search Path

Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally...

CVE-2026-63162: Improper Limitation of a Pathname to a Restricted Directory

Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by...

CVE-2026-65164: Improper Limitation of a Pathname to a Restricted Directory

NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to...

CVE-2026-65161: Improper Limitation of a Pathname to a Restricted Directory

NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure...

CVE-2026-65103: Improper Limitation of a Pathname to a Restricted Directory

NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target,...

CVE-2026-69943: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Office SharePoint allows an authorized attacker to execute code over a network...

CVE-2026-70161

Improper limitation of a pathname to a restricted directory 'path traversal' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-83873: Relative Path Traversal

Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally...

CVE-2026-83923: Relative Path Traversal

Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network...

CVE-2026-83746: Absolute Path Traversal

Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network...

CVE-2026-83865: Relative Path Traversal

Relative path traversal in Windows Internet wininet.dll allows an authorized attacker to perform tampering locally...

CVE-2026-83784: Absolute Path Traversal

Absolute path traversal in Windows Encrypting File System EFS allows an authorized attacker to elevate privileges over a network...

CVE-2026-88136: Improper Resolution of Path Equivalence

Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network...

CVE-2026-85932: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network...

CVE-2026-93347: Improper Limitation of a Pathname to a Restricted Directory

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlistfile helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read...