PT-2026-103970

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.4.1 Description A maximum severity flaw allows unauthenticated remote attackers to execute arbitrary code and gain root control of the appliance. The issue results from a chain of missing...

PT-2026-103711

Unpatched vulnerabilities don't stay hidden on our atlas. CVE CRITICAL VULNERABILITY DETECTED CVE ID → CVE-2025-41753 Vendor → Unknown Severity → Critical — CVSS 9.3 Product → Unknown Date → 2026-10-01 A critical vulnerability Path Traversal has been disclosed affecting Unknown. Patch immediately...

PT-2026-103682

A path traversal ZIP Slip vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code...

ROS-20261001-73-0020

The vulnerability in Go-Git relates to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Apache HTTPD: CVE-2026-79768: Path Equivalence: '/./' (Single Dot Directory)

Path equivalence: '/./' single dot directory vulnerability in Apache HTTP Server's moduserdir module when configured with absolute non-wildcard UserDir directive the 2nd form in https://httpd.apache.org/docs/2.4/mod/moduserdir.htmluserdir This issue affects Apache HTTP Server: from 2.4.0 through...

CVE-2026-103290: Path Traversal: '.../...//'

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server...

PT-2026-105558

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection in github.com/rabbitmq/amqp091-go...

CVE-2026-51882

The OpenAI-compatible file upload endpoint /v1/files in Langchain-Chatchat 0.3.0 is vulnerable to path traversal. An attacker can write files to arbitrary locations outside the openaifiles directory by crafting malicious filenames...

CVE-2026-51883

The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker can inject path traversal sequences such as ..\ into the knowledgebasename parameter to write knowledge base content to arbitrary locations outside the...

PT-2026-104042

The /knowledge base/upload temp docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By crafting malicious filenames, an attacker can write files to arbitrary locations on the server, bypassing the intended restrictions on the temporary directory...

PT-2026-104034

Name of the Vulnerable Software and Affected Versions Devika version 1.0 Description The save code to project function within the Feature Agent contains a path traversal flaw. This issue allows attackers to write files outside the designated project workspace, which could lead to a full server...

PT-2026-104038

Name of the Vulnerable Software and Affected Versions deeptutor version 1.4.0 Description A path traversal issue exists in the EditFileTool.execute function. A remote caller can use the live tutorbot WebSocket interface to force the tool layer to write or edit absolute paths outside the designate...

PT-2026-104012

Name of the Vulnerable Software and Affected Versions Teledyne FLIR Aware2 versions prior to 6.9.0.3 PackBot Teledyne FLIR Aware2 versions prior to 1.7.10 FirstLook Description Unvalidated pathnames in the web interface allow remote unauthenticated attackers to perform path traversal, a technique...

CVE-2026-101889: Improper Limitation of a Pathname to a Restricted Directory

The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete arbitrary directories by importing a crafted WPRIME/TAR package with manipulated tarrootfolder values in wprime-config.json. Attackers can exploit...

PT-2026-103911

Name of the Vulnerable Software and Affected Versions Prime Mover plugin for WordPress versions prior to 2.2.1 Description A Zip Slip path traversal issue exists during the migration ZIP import process. Authenticated administrators can write arbitrary files outside the intended extraction directo...

PT-2026-104060

A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in...

PT-2026-103942

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.0 through 2.4.68 Description A path equivalence issue exists in the mod userdir module when configured with an absolute non-wildcard UserDir directive. This flaw involves the use of the /./ single dot directory...

PT-2026-103822

Name of the Vulnerable Software and Affected Versions Ghost versions 6.14.0 through 6.26.x Description The ImageSize service contains a path traversal issue where insufficient input validation of user-supplied file paths allows authenticated staff users to access local files located outside the...

ROS-20261001-73-0023

The vulnerability in glib2 relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

PT-2026-103736

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...