PT-2026-112017

Name of the Vulnerable Software and Affected Versions Microsoft .NET Framework versions 3.5 through 4.8.1 Description An untrusted search path issue exists that allows an authenticated local attacker to bypass Windows Defender Application Control WDAC restrictions. The attack involves using a...

CVE-2026-110232: Improper Limitation of a Pathname to a Restricted Directory

Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../ x/file to create or overwrite files in sibling folder...

CVE-2026-70222: Relative Path Traversal

Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally...

SmartBear Collaborator Server 15.1.15101 DOORS Upload Path Traversal

SmartBear Collaborator Server version 15.1.15101 contains a post-authentication ZIP path traversal in DOORS review-file uploads that can write a Groovy Server Page into the webroot, leading to command execution. https://packetstorm.news/download/235398...

CVE-2026-74043: Improper Limitation of a Pathname to a Restricted Directory

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in uploadlistfile, uploadrulefile, and uploaddecoderfile that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filenam...

PT-2026-111570

Name of the Vulnerable Software and Affected Versions Wazuh versions 4.1.1 through 4.14.7 Description A path traversal issue exists in the upload list file, upload rule file, and upload decoder file functions. Attackers possessing the cluster key can send DistributedAPI requests containing ../...

CVE-2026-83784: Absolute Path Traversal

Absolute path traversal in Windows Encrypting File System EFS allows an authorized attacker to elevate privileges over a network...

PT-2026-112578

Name of the Vulnerable Software and Affected Versions Windows Encrypting File System EFS affected versions not specified Description An absolute path traversal issue exists in the Windows Encrypting File System EFS. This allows an authorized attacker to elevate privileges over a network...

Microsoft Windows: CVE-2026-83784: Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability

Absolute path traversal in Windows Encrypting File System EFS allows an authorized attacker to elevate privileges over a network...

PT-2026-112684

Name of the Vulnerable Software and Affected Versions OpenSSH for Windows affected versions not specified Description A relative path traversal issue allows an unauthorized remote attacker to execute arbitrary code over a network, potentially compromising the affected system. Recommendations At t...

Microsoft Windows: CVE-2026-83923: Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network...

CVE-2026-83923: Relative Path Traversal

Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network...

CVE-2026-70161: Improper Limitation of a Pathname to a Restricted Directory

Improper limitation of a pathname to a restricted directory 'path traversal' in .NET allows an authorized attacker to elevate privileges locally...

CVE-2026-106108: Improper Limitation of a Pathname to a Restricted Directory

Quasar Framework is a framework for building high-performance Vue.js user interfaces. From 3.1.0 until 3.3.0, @quasar/app-vite SSG page definitions returned by getSsgPages could supply dir and filename values that were joined to build.distDir without verifying the final destination. Parent...

VulnCheck KEV: CVE-2024-30492

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in WebToffee Import Export WordPress Users.This issue affects Import Export WordPress Users: from n/a through 2.5.2...

VulnCheck KEV: CVE-2026-48866

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Rocketgenius Inc. Gravity Forms allows Path Traversal. This issue affects Gravity Forms: from n/a through 2.10.0.1...

VulnCheck KEV: CVE-2026-1830

The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrary file uploads. This makes it possible for unauthenticated...

PT-2026-111527

A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The...

CVE-2026-83509: Untrusted Search Path

Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally...

CVE-2026-93347: Improper Limitation of a Pathname to a Restricted Directory

Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the getlistfile helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read...