PT-2026-70201

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

PT-2026-70103

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A path traversal vulnerability exists in the Offline archives functionality of the local web interface. This issue occurs because of insufficient validation of a...

PT-2026-70196

A vulnerability has been identified in Siemens License Server SLS All versions V5.3. The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application...

PT-2026-70875

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.15.120, electerm allows a malicious SFTP server to write attacker-controlled content outside the temporary directory because the server-controlled filename name used by editWithSystemEditor in...

PT-2026-70172

n8n versions before 1.123.67 contain a path traversal vulnerability in the Git node's fetch, pull, and push-tags operations that allows authenticated users to bypass repository-path containment checks. Attackers with workflow create/execute rights can point allowlisted remote configurations at...

Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0

Summary A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. Impact A local user with administrative credentials for the web interface could submit an archive name containing traversal...

ALSA-2026:53844 Important: iscsi-initiator-utils security, bug fix, and enhancement update

The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as the utility programs used to manage it. The iSCSI protocol is a protocol for distributed disk access using SCSI commands sent over Internet Protocol IP networks...

PT-2026-70924

TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at GET /api/v1/typebots/typebotId/blocks/blockId/storage/upload-url that accepts an attacker-controlled filePath and returns a presigned S3 PUT URL for that exact key. Because the endpoint only...

PT-2026-70827

XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-registered or default-credential users to read arbitrary files on the host by supplying parent-directory segments in the file name form field with no path containment check. Attackers can register an...

PT-2026-70064

Name of the Vulnerable Software and Affected Versions Crafty Controller affected versions not specified Description Path traversal exists in the server import and admin file upload features. This allows a remote, authenticated attacker to upload files to arbitrary paths accessible to the...

PT-2026-70262

Name of the Vulnerable Software and Affected Versions Zoom VDI Client and Plugins affected versions not specified Description A path traversal issue exists that may allow an authenticated user to perform information disclosure through local access. Path traversal is a flaw that allows an attacker...

RHEL 10 : iscsi-initiator-utils (RHSA-2026:53845)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:53845 advisory. The iscsi-initiator-utils packages provide the server daemon for the Internet Small Computer System Interface iSCSI protocol, as well as t...

Linux Distros Unpatched Vulnerability : CVE-2026-73030

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the iswithindirectory function that fails to normalize paths before...

PT-2026-70567

Name of the Vulnerable Software and Affected Versions Microsoft Office SharePoint affected versions not specified Description A relative path traversal issue allows an authorized attacker to disclose sensitive information over a network. Path traversal is a technique that allows an attacker to...

PT-2026-70887

The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying a...

Zoom Workplace VDI Client < 7.0.11 Vulnerability (ZSB-26018)

The version of Zoom Workplace VDI Client installed on the remote host is prior to 7.0.11. It is, therefore, affected by a vulnerability as referenced in the ZSB-26018 advisory. - Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via...

Debian dsa-6429 : caddy - security update

The remote Debian 13 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-6429 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6429-1 [email protected] https://www.debian.org/securit...

PT-2026-70888

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete revision function in all versions up to, and including, 2.8.169. This makes it possible for...

PT-2026-70895

FreeCAD is a free and open-source multiplatform 3D parametric modeler. Prior to 1.1.2, PropertyFileIncluded::Restore in src/App/PropertyFile.cpp concatenates an attacker-controlled file or data attribute from Document.xml with the document transient path without rejecting directory components,...

PT-2026-70384

CAI Content Credentials is affected by an Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access...