148793 matches found
EUVD-2026-97367
In Progress ShareFile Storage Zones Controller v5.12.6 and below, FileCopyService uses a remote file identifier when constructing a local temporary file path without enforcing containment. This can cause FileCopyService to write attacker-controlled content to filesystem locations writable by the...
CVE-2026-93695
Progress ShareFile Storage Zones Controller versions v5.12.6 and below are vulnerable to an arbitrary file write flaw in the FileCopyService . The root cause is the service's use of a remote file identifier to construct local temporary file paths without enforcing proper containment. This allows ...
Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by a path traversal vulnerability due to Apache Ant
Summary Apache Ant is used by IBM Integrated Analytics System as a Java-based build and task execution tool. CVE-2026-78254 affects Apache Ant versions prior to 1.10.18, where the ftp and scp tasks allow a malicious server or a machine-in-the-middle attacker to provide relative paths during file...
Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple vulnerabilities in system and open source components
Summary IBM Integrated Analytics System IIAS includes various open source packages, runtimes, and system libraries as part of its underlying platform. Multiple security vulnerabilities have been identified across components including Oracle Java SE, cryptography, Apache HttpComponents, libssh,...
hugo: Hugo: Information disclosure via path traversal during asset compilation
A flaw was found in Hugo. This vulnerability allows an attacker to cause unauthorized information disclosure through path traversal when processing untrusted themes or modules. By supplying relative file paths or symbolic links that reference locations outside the project directory, an attacker c...
hugo: Hugo: Information disclosure via Sass import path traversal
A flaw was found in Hugo. A path traversal vulnerability in the Sass stylesheet processing component allows malicious themes or modules to access files outside the intended project directory. By supplying crafted stylesheet import directives, an attacker can read sensitive local files and include...
Security Bulletin: IBM Application Modernization Accelerator is affected by vulnerability found in JavaScript
Summary There is a vulnerability in the JavaScript used by IBM Application Modernization Accelerator. Vulnerability Details CVEID:CVE-2026-17495 DESCRIPTION: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a...
Path Traversal
@makafeli/n8n-workflow-builder is vulnerable to path traversal. The vulnerability is due to improper validation of the filePath argument in the updatenodefromfile function in build/server.cjs, which allows a local attacker to manipulate file paths to access files outside the intended directory...
Security Bulletin: IBM Transformation Advisor is affected by vulnerability found in JavaScript
Summary There is a vulnerability in the JavaScript used by IBM Transformation Advisor. Vulnerability Details CVEID:CVE-2026-17495 DESCRIPTION: moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted...
CVE-2026-108811
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...
Security Bulletin:Vulnerabilities exists in Ant package used by IBM Netezza Appliance
Summary Vulnerabilities identified in IBM Netezza Appliance have been addressed in the latest security patch release of NPS. Vulnerability Details CVEID:CVE-2026-78254 DESCRIPTION: The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative...
K000163659: Next.js vulnerability CVE-2026-75604
Security Advisory Description Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route...
CVE-2026-78355
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...
CVE-2026-78355
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...
UBUNTU-CVE-2026-78355
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...
EUVD-2026-97284
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...
CVE-2026-108811 WMCMS index.php information disclosure
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...
CVE-2026-108811 WMCMS index.php information disclosure
A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of the argument path/file causes information disclosure. The attack is possible to be carried out remotely. The exploit has been made available to the public a...
CVE-2026-78355 Path Traversal in SendSupportBundle allows File Deletion Outside the Intended Directory
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...
EUVD-2026-97265
A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory. This may allow files accessible to the OTRS application process to be deleted. The vulnerability does not bypass operating syste...