149315 matches found
CVE-2026-51875
In Devika v1.0, the Feature Agent savecodetoproject function contains a path traversal vulnerability that allows attackers to write files outside the intended project workspace, potentially compromising the entire server...
PT-2026-104012
Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.3 PackBot Teledyne FLIR Aware2 versions prior to 1.7.10 FirstLook Description Unvalidated pathnames in the web interface allow remote unauthenticated attackers to perform path traversal, a technique...
PT-2026-103954
Name of the Vulnerable Software and Affected Versions Capacitor versions prior to 6.2.2 Capacitor versions prior to 7.6.9 Capacitor versions prior to 8.3.5 Capacitor versions prior to 8.4.3 Capacitor versions prior to 8.5.1 Description The Android and iOS WebView navigation guard validates the ho...
CVE-2026-55393: Improper Limitation of a Pathname to a Restricted Directory
Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 PackBot and 1.7.9 FirstLook allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook robots running this software via path traversal...
CVE-2026-103290: Path Traversal: '.../...//'
Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...
CVE-2026-103278: Relative Path Traversal
Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff user accounts. Attackers with content publishing privileges can craft malicious pages that, when visited by active staff users, enable account takeover through...
CVE-2026-103664: Improper Neutralization of Input During Web Page Generation
MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...
PT-2026-105841
Summary Missing path validation in confluence upload attachment allows any authenticated MCP client to read arbitrary files from the server filesystem and exfiltrate their contents to Confluence. On Linux deployments, /proc/self/environ yields all runtime secrets in a single call. --- Details...
CVE-2025-41753: Improper Limitation of a Pathname to a Restricted Directory
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the...
CVE-2026-82824: Path Traversal: '.../...//'
Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0...
CVE-2026-51884
The /knowledgebase/uploadtempdocs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory...
ROS-20261001-73-0053
The vulnerability in rclone relates to an incorrect restriction on the path name of the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
CVE-2026-55231: Improper Limitation of a Pathname to a Restricted Directory
Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed central path sanitizer lets an authenticated admin-panel user who holds backup access default role siteadmin or higher read and delete arbitrary files on a...
PT-2026-103910
In Eclipse BaSyx AAS Web UI versions v2-241220 through releases before v2-260924, the shared request handler attached the selected infrastructure's Authorization header to outgoing requests without checking the destination origin. In deployments using authentication, an attacker could induce a us...
ROS-20261001-73-0023
The vulnerability in glib2 relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
CVE-2026-51884
The Langchain Chatchat 0.3.1 software contains a path traversal vulnerability in the /knowledge_base/upload_temp_docs temporary document upload endpoint. An attacker can exploit this by crafting malicious filenames to write files to arbitrary locations on the server, effectively bypassing intende...
CVE-2026-51882: Improper Limitation of a Pathname to a Restricted Directory
The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...
PT-2026-105109
kyverno before 1.19.1 fails to properly validate URL-encoded path segments in Policy apiCall urlPath, allowing namespace tenants to bypass the per-namespace clamp and create objects in other namespaces as the admission-controller ServiceAccount. Attackers can exploit this by using percent-encoded...
CVE-2026-103533: Improper Limitation of a Pathname to a Restricted Directory
A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/511 of the file app/Http/Requests/Api/V1/RestoreRequest.php of the component database-servers API Endpoint. The manipulation of the argument schemaname result...