147598 matches found
PT-2026-111707
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters...
Microsoft Windows: CVE-2026-102217: WebDAV Elevation of Privilege Vulnerability
Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network...
WS-2026-0131
mise formerly rtx-cli before 2026.10.9: a path: tool version e.g. node path:./local in an untrusted project's .tool-versions or mise.toml is not subject to the config trust check, so mise activate prepends the project-controlled directory to PATH on cd without a trust prompt, letting a repository...
CVE-2026-90530: Improper Limitation of a Pathname to a Restricted Directory
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...
Microsoft Windows: CVE-2026-70142: Windows Update Service Elevation of Privilege Vulnerability
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69968: Relative Path Traversal
Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network...
CVE-2026-69973: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory 'path traversal' in Windows Libarchive allows an unauthorized attacker to perform tampering over a network...
CVE-2026-69979: Improper Protection of Alternate Path
Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally...
CVE-2026-83509: Untrusted Search Path
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...
CVE-2026-83506: Untrusted Search Path
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally...
CVE-2026-83683: Absolute Path Traversal
Absolute path traversal in Windows Encrypting File System EFS allows an authorized attacker to disclose information over a network...
CVE-2026-74031: Improper Limitation of a Pathname to a Restricted Directory
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the deleterulefile and deletedecoderfile helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through...
CVE-2026-74033: Improper Limitation of a Pathname to a Restricted Directory
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlists and deletelistfile CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path,...
CVE-2026-74043: Improper Limitation of a Pathname to a Restricted Directory
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...
CVE-2026-70142: Untrusted Search Path
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally...
CVE-2026-63162: Improper Limitation of a Pathname to a Restricted Directory
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by...
CVE-2026-65164: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA AIStore for Linux contains a path traversal vulnerability in the dSort archive extraction component where a remote attacker may cause an improper limitation of a pathname to a restricted directory by supplying crafted archive member names to a dSort job. A successful exploit may lead to...
CVE-2026-65161: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure...
CVE-2026-65103: Improper Limitation of a Pathname to a Restricted Directory
NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target,...