8045 matches found
PT-2026-4109
Name of the Vulnerable Software and Affected Versions AivahThemes Hostme v2 versions through 7.0 Description A Path Traversal issue exists in AivahThemes Hostme v2. The issue allows an attacker to traverse directory restrictions via improper pathname limitation. The API endpoint is not mentioned...
PT-2026-4143
Name of the Vulnerable Software and Affected Versions SeaTheme BM Content Builder versions through 3.16.3 Description A Path Traversal issue exists in SeaTheme BM Content Builder. The issue allows an attacker to traverse to restricted directories. The vulnerability is present in the bm-builder...
GHSA-VC2W-4V3P-2MQW Apache Solr: Insufficient file-access checking in standalone core-creation requests
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting...
CVE-2026-22444
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting...
CVE-2026-22444
The CVE-2026-22444 issue affects Apache Solr in standalone mode (versions 8.6–9.10.0) where the create core API performs inadequate input validation on certain API parameters. This can cause Solr to check and read file-system paths that should be blocked by the allowPaths setting, potentially all...
EUVD-2026-3665
The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's "allowPaths" security setting...
MiracleLinux 8 : vim-8.0.1763-15.el8 (AXSA:2020-998:02)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2020-998:02 advisory. vim: users can execute arbitrary OS commands via scripting interfaces in the rvim restricted mode CVE-2019-20807 Tenable has extracted the preceding descripti...
Qnap QTS and QuTS hero Improper Limitation of a Pathname to a Restricted Directory (CVE-2025-59380)
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the...
Qnap QTS and QuTS hero Improper Limitation of a Pathname to a Restricted Directory (CVE-2025-59381)
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the...
The vulnerability of the Node.js software platform, related to incorrect restrictions on path names for directories with restricted access, allows attackers to compromise the system.
The vulnerability of the Node.js software platform is related to incorrect restrictions on path names for directories with restricted access. Exploiting this vulnerability can allow an attacker to compromise the system...
Qnap QTS and QuTS hero Improper Limitation of a Pathname to a Restricted Directory (CVE-2023-51364)
A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the contents of unexpected files and expose sensitive data via a network. We have already fixed the vulnerability in the following versions:...
WordPress WP-Members Membership plugin cross-site scripting vulnerability
WordPress WP-Members Membership plugin is an open source membership plugin for WordPress that is mainly used to create membership sites with restricted content. WordPress WP-Members Membership plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of...
MiracleLinux 7 : bash-4.2.46-34.el7 (AXSA:2020-4537:01)
The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-4537:01 advisory. bash: BASHCMD is writable in restricted bash shells CVE-2019-9924 Tenable has extracted the preceding description block directly from the MiracleLinux securi...
CVE-2024-54556
This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from the lock screen...
CVE-2025-15527
The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the apigetpostsummary function due to insufficient restrictions on which posts can be retrieved. This makes it possible for authenticated attackers, with Contributor-level...
CVE-2024-54556
This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from the lock screen...
CVE-2024-54556
This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from the lock screen...
CVE-2024-54556
This issue was addressed through improved state management. This issue is fixed in iOS 18.1 and iPadOS 18.1. A user may be able to view restricted content from the lock screen...
CVE-2024-54556
CVE-2024-54556 affects Apple devices running iOS 18.1 / iPadOS 18.1. The issue enables viewing restricted content from the lock screen due to a state-management flaw and has been fixed in the 18.1 updates. The description across sources consistently notes a "improved state management" fix with th...
