CVE-2026-72569

The CVE-2026-72569 entry describes a path traversal vulnerability in cube-root/directory-serve

CVE-2026-72567

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

CVE-2026-72567

The CVE-2026-72567 entry concerns AsyncFuncAI/deepwiki-open. A path traversal flaw arises from improper validation in the wiki-cache API endpoint (api/api.py) which builds file paths from user-controlled owner, repo, and repo_type fields, allowing unauthenticated remote actors to write to or dele...

CVE-2026-72567 deepwiki-open - Unauthenticated Path Traversal Leading to Arbitrary File Write and Delete

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

EUVD-2026-55239

An improper path validation vulnerability in AsyncFuncAI/deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to write to or delete arbitrary files with root privileges. The api/api.py wiki-cache endpoint constructs file paths from user-controlled owner, repo, and repotype...

CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66484 Path Traversal in GNU cpio

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66484

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-66484 Path Traversal in GNU cpio

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

EUVD-2026-55256

GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When extracting a tar archive in copy-in mode with the --no-absolute-filenames option, the extracted file name is normalized but the tar hard-link target is passed to the linktoname function without...

CVE-2026-21082

Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

EUVD-2026-55107

Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21082

Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21082

Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information...

CVE-2026-21082

The CVE-2026-21082 entry identifies a relative path traversal vulnerability in Samsung Health prior to version 7.0.0, allowing local attackers to access sensitive information. Affected software: Samsung Health (pre-7.0.0). Root cause: relative path traversal. Impact: confidentiality of data may b...

EUVD-2026-54956

A vulnerability was determined in bartekke8it56w2 new-mcp 0.1.0. This impacts the function fs.writeFileSync/fs.existsSync/fs.readFileSync of the file index.ts of the component geminithinking. This manipulation of the argument sessionCommand/sessionPath causes path traversal. The attack requires...

EUVD-2026-54959

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

EUVD-2026-54958

A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfyuploadimage. Such manipulation of the argument imagepath leads to path traversal. An attack has to be approached locally. The project...

The vulnerability of the Syslog Server server, a management tool for virtual infrastructure in VMware vCenter Server, allows a attacker to execute arbitrary code.

The vulnerability of the Syslog Server server used in managing the virtual infrastructure of VMware vCenter Server is related to an incorrect limitation on the path name to the directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2026-69945

Name of the Vulnerable Software and Affected Versions unearth versions prior to 0.18.2 Description A path traversal issue exists in the is within directory function, which fails to normalize paths before validation. This allows ../ sequences to bypass directory containment checks. An attacker can...