Export limit exceeded: 11519 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11519 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-110235 | 1 Abdurazaaq Mohammed | 1 Mp Manager | 2026-10-19 | 5.5 Medium |
| MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage. | ||||
| CVE-2026-41544 | 1 Qnap Systems | 1 Qcalagent | 2026-10-19 | N/A |
| A path traversal vulnerability has been reported to affect QcalAgent. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: QcalAgent 1.1.10 and later | ||||
| CVE-2026-110253 | 2 Boldgrid, Wordpress-extensions | 2 Weforms, Weforms | 2026-10-19 | 5.4 Medium |
| The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media file deletion due to insufficient file path validation in the weforms_delete_entry_attachments function in all versions up to, and including, 1.6.28 This makes it possible for unauthenticated attackers to delete arbitrary media files on the server. This requires an administrator to permanently delete the poisoned form entry, a routine moderation action for spam-looking submissions that an attacker can prompt through social engineering. | ||||
| CVE-2026-110657 | 1 Khronos | 2 Nnef, Nnef-tools | 2026-10-19 | 3.3 Low |
| Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write files outside the model directory via crafted variable labels. Attackers can supply a graph.nnef with '../' sequences or absolute paths in labels to create or overwrite '.dat' files when users convert, save, or generate weights. | ||||
| CVE-2026-110766 | 1 Colanode | 1 Colanode | 2026-10-19 | 4.3 Medium |
| Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by supplying an encoded traversal sequence in avatarId. Attackers can send percent-encoded ../ sequences to GET /client/v1/avatars/:avatarId to escape the avatars directory and read .jpeg files belonging to other workspaces. | ||||
| CVE-2026-110746 | 1 Totalsecurity | 1 Totalav | 2026-10-19 | 7.8 High |
| A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM. | ||||
| CVE-2026-105032 | 1 Energizelab | 1 Fastapi Ai Inference Server | 2026-10-19 | 9.1 Critical |
| The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots. | ||||
| CVE-2026-94666 | 2 Wordpress-extensions, Zealousweb | 2 Generate Pdf Using Contact Form 7, Generate Pdf Using Contact Form 7 | 2026-10-19 | 7.5 High |
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7 generate-pdf-using-contact-form-7 allows Path Traversal.This issue affects Generate PDF using Contact Form 7: from n/a through 4.2.1. | ||||
| CVE-2026-97348 | 2 Gpriday, Wordpress-extensions | 2 Siteorigin Widgets Bundle, Siteorigin Widgets Bundle | 2026-10-19 | 6.5 Medium |
| The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.74.3 via the get_instance_css function. This makes it possible for authenticated attackers, with contributor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The widget's normal update()/sanitize_field_input() pipeline — which would reject non-hex color values — is bypassed entirely because the [siteorigin_widget] shortcode handler calls $the_widget->widget() directly on the attacker-supplied decoded JSON instance. | ||||
| CVE-2026-104763 | 1 Wpazleen | 1 Post Export Import With Media | 2026-10-19 | 4.9 Medium |
| The Post Export Import with Media plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.17.1 via the 'file_path' parameter parameter. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. This requires the attacker to upload a crafted ZIP archive containing a media_metadata.json file with path traversal sequences in the file_path field while specifying an allowed file extension for the destination filename to bypass the extension guard introduced in version 1.13.2. | ||||
| CVE-2026-112015 | 1 Omnigent-ai | 1 Omnigent | 2026-10-18 | 7.5 High |
| Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user. | ||||
| CVE-2026-71492 | 1 Masci | 1 Banks | 2026-10-18 | 6.5 Medium |
| Banks generates meaningful LLM prompts using a simple template language. Prior to version 2.4.5, DirectoryPromptRegistry.set() in src/banks/registries/directory.py interpolates attacker-controlled Prompt.name and Prompt.version values into a Path without canonicalization or containment validation. Relative traversal such as ../victim/foo and an absolute Prompt.name can escape or discard the configured registry root, while overwrite=True permits replacement of existing target files. The poisoned name is persisted in index.json and reconstructed by _load(), allowing the out-of-root path to survive later registry loads. An application that forwards request data into these fields can therefore write Prompt.raw bytes to attacker-chosen paths writable by the application process. This issue is fixed in version 2.4.5. | ||||
| CVE-2026-74043 | 1 Wazuh | 2 Wazuh, Wazuh-manager | 2026-10-18 | 9 Critical |
| Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that allows malicious cluster workers to write files at arbitrary paths. Attackers holding the cluster key can send DistributedAPI requests with ../ sequences in filename, bypassing REST controller validation, to write files as the wazuh user. | ||||
| CVE-2026-78851 | 1 Getgrav | 1 Grav Cms | 2026-10-18 | 6.5 Medium |
| Directory Traversal vulnerability in Grav CMS 2.0.3 through 2.0.6 allows a remote attacker to obtain sensitive information via the GravExtension.php and the mediaDirFunc method. | ||||
| CVE-2026-58393 | 1 Opnsense | 1 Core | 2026-10-17 | 5.9 Medium |
| OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN Client Specific Override common_name field accepts path traversal sequences and openvpn_csc_conf_write() concatenates the value into /var/etc/openvpn-csc/<vpnid>/<common_name> without normalization or a basename check. The affected event handlers are client_connect.php and user_pass_verify.php. An authenticated user with Client Specific Override privileges can store the traversal value, and a matching OpenVPN client-connect or authentication event causes a generated CSO file to be written outside the intended directory. The file content is generated OpenVPN configuration rather than arbitrary bytes, and practical exploitation requires the attacker to cause a matching common name or username to be processed. This issue is fixed in version 26.1.11. | ||||
| CVE-2026-59774 | 1 Gitea | 1 Gitea | 2026-10-17 | 9.8 Critical |
| Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account. | ||||
| CVE-2026-62664 | 1 Error311 | 1 Filerise | 2026-10-17 | 5.4 Medium |
| FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.19.0, FileRise validates the complete folderName string but does not reject dot-dot path segments before FolderModel::createFolder() constructs and creates the destination. An authenticated low-privileged user with a valid CSRF token and create or owner permission on the parent can submit traversal segments to POST /api/folder/createFolder.php and create directories outside UPLOAD_DIR wherever the web-server account can write. This issue is fixed in version 3.19.0. | ||||
| CVE-2026-63130 | 1 Espocrm | 1 Espocrm | 2026-10-17 | 5.5 Medium |
| EspoCRM is an open source customer relationship management application. Prior to 9.3.10, an authenticated administrator can provide crafted input to the administrative Label Manager. Insufficient path validation allows traversal outside the intended directory and permits reading, modifying, creating, or deleting JSON files accessible to the application, subject to filesystem permissions and server configuration. This issue is fixed in version 9.3.10. | ||||
| CVE-2026-62679 | 1 Lycheeorg | 1 Lychee | 2026-10-17 | N/A |
| Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the attacker-controlled path with the local storage root and performs a string-prefix check before canonicalizing dot segments. Under the supported non-default configuration with temporary_image_link_enabled enabled, temporary_image_link_when_logged_in disabled, and secure_image_link_enabled disabled, any authenticated user can submit encoded traversal segments that pass the prefix check and are later resolved by filesystem operations. This permits reading files available to the web process, including application configuration and other users' private images, and disclosed APP_KEY or database credentials can enable further compromise. This issue is fixed in version 7.6.4. | ||||
| CVE-2026-24718 | 1 Qnap Systems | 1 Qsync Central | 2026-10-17 | N/A |
| A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qsync Central 5.0.0.7 and later Qsync Central 5.1.0.3 and later Qsync Central 5.2.0.5 and later Qsync Central 5.3.0.2 and later | ||||