Exploit for Path Traversal in Rubyonrails Rails

Ruby on Rails Accept Header File Disclosure CVE-2019-5418...

CVE-2026-53713

A flaw was found in Envoy Gateway. An authenticated attacker with permissions to submit Lua extension policies can bypass file path restrictions by submitting paths containing redundant slashes. This flaw allows the attacker to read arbitrary files from the gateway controller container, resulting...

Exploit for Path Traversal in Unbit Uwsgi

uWSGI PHP Plugin Path Traversal CVE-2018-7490 Vulhubhttp...

Exploit for Path Traversal in Igniterealtime Openfire

Openfire Admin Console Authentication Bypass CVE-2023-32315...

RHLW-2026-F33A833F49F3FD86 Lightwell Security Advisory: commons-io 2.2.0.rhlw-00004

Red Hat Lightwell has released commons-io:commons-io 2.2.0.rhlw-00004 with backported fixes for CVE-2021-29425 and CVE-2024-47554. CVE-2021-29425: In Apache Commons IO before 2.7, When invoking the method FileNameUtils.normalize with an improper input string, like "//../foo", or "\..\foo", the...

Exploit for Path Traversal in Adobe Coldfusion

Adobe ColdFusion 8 Directory Traversal CVE-2010-2861 Vulhu...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the path tokenizer in cairosvg/path.py, where the path function uses repeated string splitting on SVG path data, resulting in quadratic time complexity. An attacker can supply an SVG file containin...

GHSA-C3JG-QH8M-J3H2 CairoSVG: Quadratic-time DoS parsing a crafted SVG <path>

Summary Rendering an untrusted SVG whose contains many segments is On² CPU. A single under 1 MiB burns tens of seconds. Two independent On² sites in cairosvg/path.py: 1. Tokenizer — the path-data parser consumes the d string with a while string: loop that repeatedly slices/re-scans the remaining...

Exploit for Path Traversal in Jenkins

Jenkins CLI Arbitrary File Read CVE-2024-23897 Vulhubhtt...

Security Bulletin: IBM i is Affected By Relative Path Traversal Vulnerability in OpenSSH [CVE-2026-59995]

Summary IBM i is vulnerable to not properly constraining the location of downloaded files when "sftp server:/path" is used CVE-2026-59995 in OpenSSH as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2026-59995 DESCRIPTION: sftp in OpenSSH before 10.4 does not...

CVE-2026-84275 IBM Guardium Data Protection Path Traversal

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector...

CVE-2026-84275

IBM Guardium Data Protection 12.2 is vulnerable to a path traversal flaw within the GIM file-upload functionality . This vulnerability allows an unauthenticated attacker to perform a traversal attack to write arbitrary files to the Collector . No specific remediation information or exploit detail...

CVE-2026-84275 IBM Guardium Data Protection Path Traversal

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector...

EUVD-2026-95235

IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the GIM file-upload functionality. An unauthenticated attacker could exploit this vulnerability to write arbitrary files to the Collector...

Security Bulletin: IBM SPSS Modeler is affected by an Apache Ivy path traversal vulnerability that could allow arbitrary file overwrite during package processing

Summary IBM SPSS Modeler is affected by an Apache Ivy path traversal vulnerability that could allow arbitrary file overwrite during package processing. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-26032 DESCRIPTION: The PackagerResolver of Apache Ivy is...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

Security Bulletin: Multiple vulnerabilities affect Data Virtualization on IBM Software Hub (September 2026 - Part 2 of 2)

Summary Multiple vulnerabilities have been addressed in Data Virtualization on IBM Software Hub. Note that Data Virtualization was named Watson Query on IBM Cloud Pak for Data version 4.8. Vulnerability Details CVEID:CVE-2026-69153 DESCRIPTION: PostCSS takes a CSS file and provides an API to...

CVE-2026-107704

The image_optimizer Ruby gem versions 1.3.0 through 1.9.0 contains an OS command injection vulnerability in the ImageOptimizer#identify_format function. When the identify option is enabled, an attacker who can control the image path—such as through an uploaded file name—can append shell metachara...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...

CVE-2026-107704 image_optimizer 1.3.0 through 1.9.0 OS Command Injection via identify_format

The imageoptimizer Ruby gem 1.3.0 through 1.9.0 contains an OS command injection vulnerability in ImageOptimizeridentifyformat that allows attackers to execute commands by supplying a crafted image path when the identify option is enabled. Attackers controlling the path, such as an uploaded file...