149263 matches found
CVE-2026-5049
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...
CVE-2026-5049
A path traversal vulnerability exists in the Zone Alias Import flow feature of the HPE B-Series SANnav Management Portal (prior to versions 3.0.0a and 3.0.1 ) and Brocade SANnav (before 3.0.0a ). A local authenticated attacker can exploit this flaw to write uploaded content outside the intended d...
Exploit for Improper Access Control in Ollyo Helix3
CVE-2026-49049 — Helix3 Joomla Unauthenticated Arbitrary JSO...
CVE-2026-87685
An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...
CVE-2026-87685
An arbitrary file manipulation vulnerability exists in the WebTools management interface of Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1. When processing configuration transfer requests, the application fails to properly validate and sanitize a user-supplied status file pa...
CLEANSTART-2026-AM86994 Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is config...
Security vulnerability affects the apache-nifi-registry package. Applications using Spring Framework's FreeMarker integration may be vulnerable to a path traversal attack when a controller returns a view name derived from untrusted input and FreeMarker is configured to resolve templates through...
PT-2026-107826
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...
CVE-2026-105275: Relative Path Traversal
Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authenticated user with Viewer privileges could access file paths outside the intended directory and use observable application responses to determine whether files...
CVE-2026-107318: Improper Certificate Validation
@fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP or HTTPS server. In versions prior to 12.7.0, all of the built-in HTTPS transports override the secure default and set rejectUnauthorized to false, so the proxy does not verify the TLS certificate of the upstream...
CVE-2026-107333: Incorrect Authorization
Malcolm's nginx based reverse proxy contains a URL path normalization inconsistency between its Lua based role-based access control RBAC authorization layer and nginx's own request routing logic. An authenticated user can craft a specially formatted request path to bypass role-based restrictions...
PT-2026-108279
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to cause a denial of service due to a path traversal vulnerability...
PT-2026-108208
Name of the Vulnerable Software and Affected Versions @fastify/reply-from versions prior to 12.7.0 Description Built-in HTTPS transports in this Fastify plugin override the secure default by setting rejectUnauthorized to false. This prevents the proxy from verifying the TLS certificate of the...
Aruba ClearPass Policy Manager 6.14.x < 6.14.1 Path Traversal (HPESBNW05158)
The version of Aruba ClearPass Policy Manager installed on the remote host is 6.14.x prior to 6.14.1. It is, therefore, affected by a path traversal vulnerability as referenced in the HPESBNW05158 advisory. - An authenticated path traversal vulnerability exists in the command line interface of...
EulerOS 2.0 SP15 : spice-vdagent (EulerOS-SA-2026-3952)
According to the versions of the spice-vdagent packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A path traversal vulnerability was found in spice-vdagent. This flaw allows a malicious or compromised SPICE host to write arbitrary files ...
PT-2026-107917
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is...
PT-2026-108152
Name of the Vulnerable Software and Affected Versions ppt2png versions 0.0.1 through 0.0.6 Description An OS command injection flaw exists where attackers can execute operating system commands by providing unsanitized input or output path arguments. This occurs when shell metacharacters, such as ...
CVE-2026-103663: Relative Path Traversal
Ollama is vulnerable to path traversal in the /api/pull endpoint due to insufficient validation of layer digests by the digestToPath function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model...
CVE-2026-5049: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory...
CVE-2026-82900: Improper Limitation of a Pathname to a Restricted Directory
IBM Guardium Data Protection 12.2.2, and 12.1 could allow a remote attacker to delete arbitrary files due to improper limitation of a pathname to a restricted directory...
RHLW-2026-9CAB5871D815DD9D Lightwell Security Advisory: logback-classic 1.5.9.rhlw-00031
Red Hat Lightwell has released ch.qos.logback:logback-classic 1.5.9.rhlw-00031 with backported fixes for CVE-2024-12798, CVE-2024-12801, CVE-2026-10532, and CVE-2026-19880. CVE-2024-12798: ACE vulnerability in JaninoEventEvaluator by QOS.CH logback-core upto including version 0.1 to 1.3.14...