CVE-2026-94489: Undefined Security Weakness

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The exact code first shipped in 1.6.0, does not exist in the cited 1.0.0, and in every version where i...

ROS-20260922-73-0113

The vulnerability in golang-github-rancher-local-path-provisioner is related to errors in handling relative pathnames to the directory. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2026-96951

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions 0.17.0 through 0.21.0 Description A path traversal issue exists in the confluence upload attachment tool. The file path variable is passed directly to the open function without proper validation, allowing a caller to rea...

PT-2026-96950

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Missing path validation in the confluence upload attachment function allows an authenticated client to read arbitrary files from the server filesystem and exfiltrate their contents to a...

PT-2026-96968

Name of the Vulnerable Software and Affected Versions Adobe Connect affected versions not specified Description An Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal, allows for arbitrary file system read. This issue enables an attacker to access sensitive...

PT-2026-97085

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description Improper path canonicalization allows a remote attacker to read arbitrary files. Path canonicalization is the process of converting a file...

PT-2026-97090

Name of the Vulnerable Software and Affected Versions IBM Financial Transaction Manager FTM for RedHat OpenShift affected versions not specified Description A path traversal issue exists that could allow a remote authenticated attacker to modify server files. Path traversal is a flaw that allows ...

PT-2026-97014

Name of the Vulnerable Software and Affected Versions Apache HTTP Server affected versions not specified Description The Apache Lounge Windows distribution of Apache HTTP Server contains a hardcoded configuration path within the openssl.cnf path. This flaw can allow a local attacker to achieve co...

PT-2026-96903

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The Jira and Confluence attachment upload tools fail to validate file paths, allowing for path traversal. An authenticated MCP client or an AI assistant manipulated via prompt injection can...

PT-2026-96945

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or multi-user deployments, a caller can cross the...

PT-2026-96770

In MISP, the statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checking for the existence of an organization logo image. The original code called file exists with a path constructed as APP . 'webroot' . DS . 'img' . DS . 'orgs'...

PT-2026-96748

Name of the Vulnerable Software and Affected Versions NVIDIA Infrastructure Controller for Linux affected versions not specified Description An issue exists where an attacker can achieve external control of a file name or path. This could lead to code execution, escalation of privileges, data...

PT-2026-96954

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The confluence upload attachment and confluence upload attachments tools do not validate that the provided source path is confined to an allowed directory before opening the file. A caller can...

PT-2026-96716

Name of the Vulnerable Software and Affected Versions dgtlmoon changedetection.io versions prior to 0.60.8 Description A path traversal issue exists in the visual selector data component within the static content function of the changedetectionio/flask app.py file. A remote attacker can manipulat...

PT-2026-96811

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.5 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified SLCx-03 affected versions not specified SLCx-02 affected versions not specified Description A...

PT-2026-96952

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description The upload attachment function in both the Jira and Confluence modules fails to constrain the resolved path to the server workspace, allowing the use of absolute paths and traversal sequences...

PT-2026-97034

Name of the Vulnerable Software and Affected Versions openCode version 1.18.26 Description Missing path validation in the Worktree.remove component allows attackers to perform arbitrary recursive directory deletion using a crafted payload. This issue is a path traversal flaw, which occurs when an...

PT-2026-96854

Name of the Vulnerable Software and Affected Versions MikroTik RouterOS versions prior to 7.25beta4 Description An improper input validation issue exists in the labelled-VPN NLRI iterators of the routing service. An unauthenticated on-path attacker can crash the BGP service by sending a malformed...

PT-2026-96810

Name of the Vulnerable Software and Affected Versions Lantronix SLC8000 versions prior to 9.7.0.5 Lantronix EMG8500 versions prior to 9.7.0.1 Lantronix EMG7500 versions prior to 9.7.0.1 Lantronix SLB882 affected versions not specified Lantronix SLCx-03 affected versions not specified Lantronix...

PT-2026-96326

Name of the Vulnerable Software and Affected Versions Dancer2 versions 2.1.0 through 2.1.x Description The File route handler allows the serving of files from outside the public dir directory through the use of relative path segments. This occurs because the handler joins the request path to the...