147993 matches found
VulnCheck KEV: CVE-2017-20284
Caucho Resin contains a path traversal vulnerability in the documentation webapp resin-doc that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests...
CVE-2026-84904: Missing Authorization
The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing...
CVE-2026-6205: External Control of File Name or Path
An external control of file name or path vulnerability in Upload API in Synology DiskStation Manager DSM before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009-4 and 7.4-90075 allows remote authenticated users to write arbitrary files and conduct denial-of-service attacks...
CVE-2026-40532: Direct Request
A direct request 'forced browsing' vulnerability in Wallpaper Path in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain sensitive information...
CVE-2026-40535: Improper Limitation of a Pathname to a Restricted Directory
An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Desktop API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote attackers to write limited files and conduct limited denial-of-service attacks...
CVE-2017-20284: Improper Limitation of a Pathname to a Restricted Directory
Caucho Resin contains a path traversal vulnerability in the documentation webapp resin-doc that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests...
PT-2026-95320
Name of the Vulnerable Software and Affected Versions Synology DiskStation Manager versions prior to 7.2.1-69057-10 Synology DiskStation Manager versions prior to 7.2.2-72806-7 Synology DiskStation Manager versions prior to 7.3.2-86009-2 Description A forced browsing issue exists in the Wallpaper...
CVE-2026-82896: Improper Limitation of a Pathname to a Restricted Directory
IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to traverse directories on the system due to a path traversal vulnerability...
PT-2026-95193
Name of the Vulnerable Software and Affected Versions NASA CryptoLib version 1.5.0 Description An authentication downgrade issue exists in the Telecommand TC receive path. The receiver selects the Security Association SA used for Space Data Link Security SDLS processing based only on the SPI fiel...
WordPress Core <= 7.1 - Contributor+ Path Traversal in REST Templates Controller vulnerability
Contributor+ Path Traversal in REST Templates Controller vulnerability discovered by Anthropic in WordPress core versions = 7.1...
PT-2026-95916
Name of the Vulnerable Software and Affected Versions The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 4.5.0 Description The plugin fails to verify if the user saving a gallery is the actual owner. This allows any user with the gallery-management capability to overwrite...
CVE-2026-87743: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
A flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a...
CVE-2026-77385: Authorization Bypass Through User-Controlled Key
Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-encoded filesystem path to the transcoder. The path handling in transcoder/src/api/path.go cleaned the value and checked only that it bega...
PT-2026-95641
Caucho Resin contains a path traversal vulnerability in the documentation webapp resin-doc that allows remote unauthenticated attackers to read arbitrary files by supplying a relative path through the inputFile request parameter of the jndi-appconfig tutorial servlet. Attackers can craft requests...
CVE-2026-40536: Improper Limitation of a Pathname to a Restricted Directory
An improper limitation of a pathname to a restricted directory 'path traversal' vulnerability in Audio API in Synology DiskStation Manager DSM before 7.2.1-69057-10, 7.2.2-72806-7 and 7.3.2-86009-2 allows remote authenticated users to obtain non-sensitive information...
EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-3716)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-3763)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
WP < 7.1.1 - Author+ Path Traversal via Templates REST API
Description WordPress does not properly validate template identifiers passed to a REST API endpoint in some cases, which could allow users with a role as low as author to read HTML files outside of the themes directory via path traversal...
Tenda i6 Wi-Fi router Bypass Catalog
The vulnerability of function R7WebsSecurityHandler in the Tenda i6 Wi-Fi router software is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability could allow a remote attacker to bypass the directory structure...
Adobe Photoshop Code Execution
The vulnerability of the Adobe Photoshop graphic editor is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow a hacker to execute arbitrary code...