147564 matches found
CVE-2026-103412: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...
CVE-2026-104081: Improper Limitation of a Pathname to a Restricted Directory
KodExplorer before 4.55 contains a path traversal vulnerability in the unzipprename function within app/function/helper.function.php, where a single non-recursive strreplace sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract call in...
CVE-2026-108158: Improper Limitation of a Pathname to a Restricted Directory
plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then...
CVE-2026-108156: External Control of File Name or Path
LobsterAI 2026.5.27 through 2026.9.23 contains an external control of file path vulnerability in the skills:delete IPC handler that trusts the openclawSourceDir value from a skill's meta.json during uninstall. Attackers who convince a user to install a crafted skill can make uninstallation...
PT-2026-109303
Name of the Vulnerable Software and Affected Versions Contao versions prior to 5.3.50 Contao versions prior to 5.7.12 Description An issue exists where the ImagesController joins the user-controlled path parameter to the configured image target directory using Path::join without utilizing...
PT-2026-108893
Improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Apache Camel Karavan. A project file name supplied through the project file API was used verbatim as a path segment when the project was written to the working copy for a Git commit, so a name containing...
Linux Distros Unpatched Vulnerability : CVE-2026-19585
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which...
Apache HTTP Server 2.4.49 Path Traversal
Apache HTTP Server version 2.4.49 contains a path traversal flaw that can disclose files outside the document root and, with CGI enabled, allow command execution. This proof of concept provides a vulnerable container and reproduction commands. https://packetstorm.news/download/235010...
CVE-2026-75353
OpENer v2.3/ commit 76b95cf, contains an out-of-bounds read in the server-side EtherNet/IP ForwardOpen connection-path parser. This allows a remtoe attacker to cause a denial of service...
PT-2026-108833
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...
CVE-2026-75345: Uncontrolled Resource Consumption
OpENer v2.3.0 / commit 76b95cf contains an out-of-bounds read in the unconnected explicit messaging path. This allows a remote attacker to cause a denial of service...
CVE-2026-94664: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-contact-form-7 allows Path Traversal.This issue affects PDF for Contact Form 7: from n/a through 7.1.0...
AZL-107457 CVE-2026-56857 affecting package golang 1.26.7-1
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction...
CVE-2026-56857
On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction...
CVE-2026-21589: Critical Pre-Authentication File Read Affects Atlassian Data Center Products
Atlassian has released an out-of-band security advisory for CVE-2026-21589, a critical arbitrary file access vulnerability affecting a broad range of its Data Center products. The flaw carries a CVSS 4.0 score of 9.3 and can be exploited remotely without authentication or user interaction. Becaus...
AZL-107132 CVE-2026-89091 affecting package ansible 2.17.11-1
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...
DEBIAN-CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...
CVE-2026-89091
A flaw was found in ansible-core. When installing a collection with ansible-galaxy collection install, the archive extractor validates member paths using lexical path normalisation os.path.abspath instead of resolving symbolic links os.path.realpath, and it performs no containment check on...