CVE-2026-9769

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

EUVD-2026-64661

justhtml through 1.9.1 fixed in 1.10.0 is vulnerable to uncontrolled recursion leading to denial of service. During JustHTML construction, TreeBuilder.finish unconditionally calls populateselectedcontent, which recursively traverses the DOM tree via findelements/findelement without a depth bound...

CVE-2026-10053

GitLab CE/EE is affected by a path traversal vulnerability in the package registry component that could allow an authenticated user (low privileges) to achieve remote code execution . The vulnerability affects versions 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2. The CVSS 3.1 s...

EUVD-2026-64645

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package...

Yearning - Directory Traversal

Yearning has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information. The vulnerability is present in multiple versions of Yearning. id: CVE-2022-27043 info: name: Yearning - Directory Traversal author: Co5mos severity: high description: | Yearning h...

Joomla! Component Property - Local File Inclusion

A directory traversal vulnerability in the Real Estate Property comproperties component 3.1.22-03 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1875 info: name: Joomla...

Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion

A directory traversal vulnerability in the J!WHMCS Integrator comjwhmcs component 1.5.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1977 info: name: Joomla! Component J!WHMCS Integrator 1.5.0 - Local File...

Joomla! Component Highslide 1.5 - Local File Inclusion

A directory traversal vulnerability in the Highslide JS comhsconfig component 1.5 and 2.0.9 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1314 info: name: Joomla! Component Highslide 1.5 - Local File Inclusion...

Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion

A directory traversal vulnerability in the iNetLanka Contact Us Draw Root Map comdrawroot component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1723 info: name:...

Joomla! Component com_janews - Local File Inclusion

A directory traversal vulnerability in the JA News comjanews component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1219 info: name: Joomla! Component comjanews - Local File Inclusion author: daffainf...

Joomla! Component Online Market 2.x - Local File Inclusion

A directory traversal vulnerability in the Online Market commarket component 2.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1722 info: name: Joomla! Component Onlin...

GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability.

Barcode is a GLPI plugin for printing barcodes and QR codes. GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. id: CVE-2021-43778 info: name: GLPI plugin Barcode 2.6.1 - Path Traversal Vulnerability. author:...

WordPress DZS Zoomsounds <=6.50 - Local File Inclusion

WordPress Zoomsounds plugin 6.45 and earlier allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the dzsapdownload action using directory traversal in the link parameter. id: CVE-2021-39316 info: name: WordPress DZS Zoomsounds =6.51 to fix t...

Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion

A directory traversal vulnerability in the iNetLanka Multiple Map commultimap component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1953 info: name: Joomla! Component iNetLanka Multiple Map 1.0 - Local Fil...

WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download

Themewinter Eventin contains a path traversal caused by relative path manipulation, letting attackers access arbitrary files on the server, exploit requires no specific privileges or user interaction. id: CVE-2025-47445 info: name: WordPress Eventin Themewinter ≤ 4.0.26 - Arbitrary File Download...

Flowise - Path Traversal

Flowise = 2.2.8 contains a path traversal vulnerability caused by missing validation of chatflowId and chatId parameters in file handling, letting unauthenticated attackers read and write arbitrary files, exploit requires no authentication. id: CVE-2025-71334 info: name: Flowise - Path Traversal...

Spring Framework - Path Traversal

Spring Framework MVC applications deployed as WAR or with embedded Servlet containers that do not reject suspicious URI sequences and serve static resources with Spring resource handling contain a path traversal vulnerability, letting attackers access unauthorized files, exploit requires...

XWiki Platform - Path Traversal

XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges. id: CVE-2025-55748 info: name: XWiki Platform - Path Traversal author:...

mlflow - Path Traversal

Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. id: CVE-2023-6831 info: name: mlflow - Path Traversal author: byObin severity: high description: | Path Traversal: '..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. impact: | Authenticated attackers...

Laravel Filemanager v2.5.1 - Local File Inclusion

Laravel Filemanager aka UniSharp through version 2.5.1 is vulnerable to local file inclusion via download?workingdir=%2F. id: CVE-2022-40734 info: name: Laravel Filemanager v2.5.1 - Local File Inclusion author: arafatansari severity: medium description: | Laravel Filemanager aka UniSharp through...