147666 matches found
CVE-2026-108463: Improper Resolution of Path Equivalence
Improper resolution of path equivalence in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network...
CVE-2026-109153: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/checkpoint.py of the component Checkpoint Extraction. The manipulation results in path traversal. The attack can be executed remotely. The vendor was contacted...
CVE-2026-109519: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The...
CVE-2026-110115: Improper Limitation of a Pathname to a Restricted Directory
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters...
CVE-2026-110212: Improper Limitation of a Pathname to a Restricted Directory
Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outside the media directory via the subDir parameter of POST /api/storage/upload. Attackers can supply parent-directory sequences that...
CVE-2026-110235: Improper Limitation of a Pathname to a Restricted Directory
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting fil...
PT-2026-111783
Name of the Vulnerable Software and Affected Versions FortiSIEM versions 7.0.0 through 7.0.4 FortiSIEM versions 7.1.0 through 7.1.9 FortiSIEM versions 7.2.0 through 7.2.7 FortiSIEM versions 7.3.0 through 7.3.5 FortiSIEM versions 7.4.0 through 7.4.2 FortiSIEM version 7.5.0 Description An...
PT-2026-111707
Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters...
CVE-2026-90530: Improper Limitation of a Pathname to a Restricted Directory
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope...
Microsoft Windows: CVE-2026-70142: Windows Update Service Elevation of Privilege Vulnerability
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally...
CVE-2026-69968: Relative Path Traversal
Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network...
CVE-2026-69973: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory 'path traversal' in Windows Libarchive allows an unauthorized attacker to perform tampering over a network...
CVE-2026-69979: Improper Protection of Alternate Path
Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally...
CVE-2026-83509: Untrusted Search Path
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...
CVE-2026-83506: Untrusted Search Path
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally...
CVE-2026-83683: Absolute Path Traversal
Absolute path traversal in Windows Encrypting File System EFS allows an authorized attacker to disclose information over a network...
CVE-2026-74031: Improper Limitation of a Pathname to a Restricted Directory
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the deleterulefile and deletedecoderfile helpers that allows malicious cluster workers to delete arbitrary files via an unvalidated filename parameter. Attackers holding the cluster key can invoke these helpers through...
CVE-2026-74033: Improper Limitation of a Pathname to a Restricted Directory
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlists and deletelistfile CDB list handlers that allows compromised cluster workers to read or delete master files. Attackers can send traversal or absolute-path filenames through the internal cluster RPC path,...
CVE-2026-74043: Improper Limitation of a Pathname to a Restricted Directory
Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...