CWE-22 · Path Traversal (page 4)
Page 4 of 100 — CVEs classified under CWE-22, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-14323 | High | 7.5 | 2026-09-18 | The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.8… |
CVE-2026-70200 | Critical | 10.0 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a… |
CVE-2026-70009 | Critical | 9.3 | 2026-09-17 | Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Arc allows an unauthorized attacker to elevate privileges over a networ… |
CVE-2026-54670 | Critical | 9.1 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/control.php accepts… |
CVE-2026-54613 | Medium | 5.4 | 2026-09-17 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() in admin/controller/… |
CVE-2026-54612 | High | 8.8 | 2026-09-17 | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. From 1.0.0 until 1.0.8.5, saveGlobalElements() in admin… |
CVE-2026-54520 | High | 8.1 | 2026-09-17 | AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, the executeStep file-step imp… |
CVE-2026-54343 | | 2026-09-17 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote attacker can request a… | |
CVE-2026-53554 | | 2026-09-17 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel endpoint in backend/… | |
CVE-2026-45140 | Critical | 9.8 | 2026-09-17 | Chamilo LMS is an open-source learning management system. Prior to 2.0.1, Chamilo LMS allows an unauthenticated remote attacker to execute arbitrary code on th… |
CVE-2026-15815 | High | 8.8 | 2026-09-17 | Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic… |
CVE-2026-45723 | Low | 2.7 | 2026-09-17 | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/sch… |
CVE-2026-55062 | | 2026-09-17 | uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated h… | |
CVE-2026-54617 | Critical | 9.8 | 2026-09-17 | GravitLauncher is an open-source Minecraft launcher based on sashok724's v3. Prior to 5.7.12, an unauthenticated remote actor can send a raw HTTP request targe… |
CVE-2026-89038 | Medium | 6.2 | 2026-09-17 | Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious applications to wri… |
CVE-2026-54053 | Critical | 9.6 | 2026-09-17 | Many Notes is a Markdown note-taking web application designed for simplicity. Prior to 0.16.0, the ZIP vault import implemented in app/Actions/ProcessImportedV… |
CVE-2026-54585 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absolute source and dest… | |
CVE-2026-54583 | | 2026-09-17 | mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filename… | |
CVE-2026-93014 | High | 7.1 | 2026-09-17 | RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-lis… |
CVE-2026-93013 | Medium | 4.3 | 2026-09-17 | RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authe… |
CVE-2026-86864 | High | 8.8 | 2026-09-17 | pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare traili… |
CVE-2026-92970 | High | 8.8 | 2026-09-17 | HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary… |
CVE-2026-92945 | Medium | 4.2 | 2026-09-17 | vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored… |
CVE-2026-81829 | Medium | 5.3 | 2026-09-17 | A flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When th… |
CVE-2026-81453 | Medium | 6.5 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu… |
CVE-2026-92919 | High | 8.1 | 2026-09-17 | admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside the storage root on… |
CVE-2026-81481 | High | 7.5 | 2026-09-17 | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu… |
CVE-2026-92816 | High | 7.8 | 2026-09-16 | ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outside the output direct… |
CVE-2026-92812 | Medium | 6.8 | 2026-09-16 | decap-server contains a path traversal vulnerability in the local proxy containment guard that uses plain string prefix comparison without path separator valid… |
CVE-2026-92791 | High | 7.5 | 2026-09-16 | Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configur… |
CVE-2026-92748 | High | 8.8 | 2026-09-16 | BC Security Empire before 6.7.1 fails to validate the multipart filename parameter in upload endpoints, allowing authenticated operators to write files to arbi… |
CVE-2026-76434 | Medium | 4.9 | 2026-09-16 | A vulnerability in the certificate import functionality of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remo… |
CVE-2026-76433 | Medium | 5.3 | 2026-09-16 | A vulnerability in the client provisioning download feature of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to access protected… |
CVE-2026-76432 | Medium | 4.9 | 2026-09-16 | A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker with administrative-level pr… |
CVE-2026-76431 | Medium | 4.9 | 2026-09-16 | A vulnerability in the file management function of the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attac… |
CVE-2026-76409 | High | 8.8 | 2026-09-16 | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive inter… |
CVE-2026-89084 | | 2026-09-16 | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary fil… | |
CVE-2026-87976 | High | 8.1 | 2026-09-16 | Apache NiFi Registry 0.4.0 through 2.11.0 are subject to path manipulation when storing extension bundle content using group, artifact, and version coordinates… |
CVE-2026-86071 | Low | 3.7 | 2026-09-16 | Junrar is an open source Java RAR archive library. Prior to version 7.6.1, LocalFolderExtractor in src/main/java/com/github/junrar/LocalFolderExtractor.java ca… |
CVE-2026-63225 | Medium | 4.4 | 2026-09-16 | Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to @redocly/cli 2.33.2, the split command constructs output paths unde… |
CVE-2026-92604 | High | 8.1 | 2026-09-16 | Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role users to write attacke… |
CVE-2026-85731 | High | 8.8 | 2026-09-16 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, content/file.Store extraction of OCI layers marked with io.deis.oras.content.unpack=true ca… |
CVE-2026-59974 | High | 7.8 | 2026-09-16 | Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.co… |
CVE-2026-59944 | Medium | 6.1 | 2026-09-16 | Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the… |
CVE-2026-92137 | High | 8.8 | 2026-09-16 | Jenkins Robot Framework Plugin 6.2.2 and earlier does not check that the archive directory configured for Robot Framework report files is contained within the… |
CVE-2026-92131 | Medium | 4.2 | 2026-09-16 | Jenkins Pipeline: Groovy Libraries Plugin 805.va_fc79344957d and earlier does not restrict the library path provided to the library Pipeline step to a relative… |
CVE-2026-92355 | | 2026-09-16 | In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary… | |
CVE-2026-76555 | Medium | 6.8 | 2026-09-16 | The WP Import Export Lite WordPress plugin before 3.9.33 does not validate a user-supplied file path before reading it and copying it into a publicly accessibl… |
CVE-2026-83357 | High | 8.1 | 2026-09-15 | Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM product of Oracle Java SE (component: Compiler). The supported version that is affected is Oracle… |
CVE-2026-61560 | Critical | 9.8 | 2026-09-15 | `@zereight/mcp-gitlab` is a Model Context Protocol server for GitLab. Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools withou… |
CVE-2026-89040 | Critical | 9.8 | 2026-09-15 | Tencent Mass Service Engine in Cluster (MSEC) allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on th… |
CVE-2026-51134 | High | 7.5 | 2026-09-15 | The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml. |
CVE-2026-81568 | | 2026-09-15 | Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreModelOrderdownloads::ge… | |
CVE-2026-69201 | Medium | 5.9 | 2026-09-15 | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResourceService and WebjarService decode each URL path segment but reject only s… |
CVE-2026-57442 | | 2026-09-15 | MCPVault is a lightweight Model Context Protocol server for safe access to files in an Obsidian vault. Prior to 0.11.5, PathFilter in src/pathfilter.ts uses ro… | |
CVE-2026-48785 | Medium | 4.8 | 2026-09-15 | Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the limit container paths… |
CVE-2026-79705 | Medium | 4.5 | 2026-09-15 | A flaw was found in the buildah/copier Go package. When used outside of Buildah by a non-root caller, a crafted tar archive containing malicious symlinks can e… |
CVE-2026-54561 | Medium | 6.2 | 2026-09-15 | MCP Memory Keeper is an MCP server for persistent context management in AI coding assistants. Prior to 0.13.0, context_import in src/index.ts passes the caller… |
CVE-2026-91989 | High | 7.5 | 2026-09-15 | atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read arbitrary files by s… |
CVE-2026-91940 | High | 7.5 | 2026-09-15 | crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields function fails to validat… |
CVE-2026-91934 | High | 8.8 | 2026-09-15 | Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authenticated attackers… |
CVE-2026-87791 | | 2026-09-15 | A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia theme. The vulnerabil… | |
CVE-2026-55828 | | 2026-09-15 | qbee transport is a remote access transport protocol implementation. Prior to 1.26.25, the extractTar routine uses strictly lexical path validation that does n… | |
CVE-2026-54077 | High | 7.1 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the IMPORT DATABASE statement in engine/src/main/java/com/arcadedb/query/sql/parser/ImportDatabaseStatement.ja… |
CVE-2026-50024 | Medium | 5.3 | 2026-09-15 | GitHacker is a tool that restores Git repositories from exposed .git directories. In 1.1.7 and earlier, add_head_file_tasks parses an attacker-controlled ref p… |
CVE-2026-47215 | Medium | 4.8 | 2026-09-15 | SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string m… |
CVE-2026-91771 | High | 8.8 | 2026-09-15 | Weights & Biases wandb before 0.29.0 fails to validate the file name from server responses in the File.download function, allowing path traversal attacks. Atta… |
CVE-2026-91751 | High | 8.3 | 2026-09-15 | Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or… |
CVE-2026-91200 | High | 8.8 | 2026-09-14 | DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can… |
CVE-2026-86910 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An applicat… |
CVE-2026-86902 | Medium | 5.5 | 2026-09-14 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sonoma 14.8… |
CVE-2026-86886 | Medium | 5.5 | 2026-09-14 | A path traversal issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app… |
CVE-2026-84624 | Medium | 5.5 | 2026-09-14 | A permissions issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, m… |
CVE-2026-84598 | High | 7.5 | 2026-09-14 | A path traversal issue was addressed with improved path validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27. An attacker with phy… |
CVE-2026-84568 | High | 7.8 | 2026-09-14 | A path traversal issue was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An attac… |
CVE-2026-84541 | Medium | 5.5 | 2026-09-14 | An input validation issue was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An a… |
CVE-2026-84534 | Medium | 5.5 | 2026-09-14 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, macO… |
CVE-2026-65411 | Medium | 5.5 | 2026-09-14 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27. An app may be… |
CVE-2026-65382 | Medium | 5.5 | 2026-09-14 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8… |
CVE-2026-64790 | High | 7.8 | 2026-09-14 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be… |
CVE-2026-64756 | Medium | 5.5 | 2026-09-14 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoia 15.8, macOS Taho… |
CVE-2026-43791 | Medium | 6.5 | 2026-09-14 | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app ma… |
CVE-2026-43691 | High | 7.8 | 2026-09-14 | A path handling issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be… |
CVE-2026-73496 | High | 7.7 | 2026-09-14 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the confluence_upload_attachment and conf… |
CVE-2026-54629 | High | 7.5 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and… |
CVE-2026-50006 | Critical | 9.1 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to S… |
CVE-2026-47253 | High | 7.3 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/other_functions.go pass… |
CVE-2026-16335 | High | 8.1 | 2026-09-14 | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to read, write, or delete arbitrary files due to a path t… |
CVE-2026-15955 | High | 7.5 | 2026-09-14 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file pa… |
CVE-2026-89021 | Medium | 6.9 | 2026-09-14 | MikroTik RouterOS before 7.24.2 contains a path traversal vulnerability in the container package OCI/tar image extraction that allows attackers to write files… |
CVE-2026-82035 | High | 7.1 | 2026-09-14 | PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__main__.py, where the… |
CVE-2026-18515 | Medium | 4.3 | 2026-09-14 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to place files into the file system with Navigator for i when they should be blocked b… |
CVE-2026-55846 | Medium | 6.2 | 2026-09-14 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. Prior to 2.39.0, the HTTP server started by allure serve and allure… |
CVE-2026-55832 | Medium | 6.1 | 2026-09-14 | Tract is a tiny, no-nonsense, self-contained TensorFlow and ONNX inference toolkit. Prior to 0.21.17, 0.22.3, and 0.23.2, the tract-onnx crate passes the attac… |
CVE-2026-54178 | High | 8.1 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-54150 | | 2026-09-14 | next-video is a library for adding video to Next.js applications. Prior to 2.8.1, the GET endpoint exported by next-video/request-handler and commonly mounted… | |
CVE-2026-47256 | Medium | 5.3 | 2026-09-14 | OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry d… |
CVE-2026-57145 | Critical | 9.1 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to o… |
CVE-2026-57119 | High | 7.5 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the unauthenticated Jobs API accepts an absolute or traversing agent_file path in POST /api/v1/runs a… |
CVE-2026-56839 | High | 7.3 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to read_file, search_rep… |