CVE-2026-10732 | Medium | 6.4 | 2026-06-05 | All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two en… |
CVE-2026-24217 | High | 8.8 | 2026-05-20 | NVIDIA BioNeMo Core for Linux contains a vulnerability where a user could cause a path traversal by loading a malicious file. A successful exploit of this vuln… |
CVE-2026-5627 | High | 7.2 | 2026-04-07 | A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the `AgentFlows` component. The vulnerability ar… |
CVE-2025-15036 | Critical | 10.0 | 2026-03-30 | A path traversal vulnerability exists in the `extract_archive_to_dir` function within the `mlflow/pyfunc/dbconnect_artifact_cache.py` file of the mlflow/mlflow… |
CVE-2026-30828 | High | 7.5 | 2026-03-07 | Wallos is an open-source, self-hostable personal subscription tracker. Prior to version 4.6.2, the url parameter can be used to retrieve local system files. Th… |
CVE-2025-66608 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation.
This product does not
properly validate URLs. An attacker could send… |
CVE-2024-2356 | Critical | 9.6 | 2026-02-02 | A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `nam… |
CVE-2025-12790 | High | 7.4 | 2025-11-06 | A flaw was found in Rubygem MQTT. By default, the package used to not have hostname validation, resulting in possible Man-in-the-Middle (MITM) attack. |
CVE-2025-58291 | Low | 3.3 | 2025-10-11 | Denial of service (DoS) vulnerability in the office service. Successful exploitation of this vulnerability may affect availability. |
CVE-2025-50185 | | | 2025-07-26 | DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and… |
CVE-2025-50184 | | | 2025-07-26 | DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter i… |
CVE-2025-6209 | High | 7.5 | 2025-07-07 | A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_ut… |
CVE-2024-8982 | Medium | 6.2 | 2025-03-20 | A Local File Inclusion (LFI) vulnerability in OpenLLM version 0.6.10 allows attackers to include files from the local server through the web application. This… |
CVE-2024-8859 | High | 7.5 | 2025-03-20 | A path traversal vulnerability exists in mlflow/mlflow version 2.15.1. When users configure and use the dbfs service, concatenating the URL directly into the f… |
CVE-2024-8537 | Critical | 9.1 | 2025-03-20 | A path traversal vulnerability exists in the modelscope/agentscope application, affecting all versions. The vulnerability is present in the /delete-workflow en… |
CVE-2024-8248 | High | 7.2 | 2025-03-20 | A vulnerability in the normalizePath function in mintplex-labs/anything-llm version git 296f041 allows for path traversal, leading to arbitrary file read and w… |
CVE-2024-7957 | Critical | 9.1 | 2025-03-20 | An arbitrary file overwrite vulnerability exists in the ZulipConnector of danswer-ai/danswer, affecting the latest version. The vulnerability arises from the l… |
CVE-2024-12389 | High | 8.8 | 2025-03-20 | A path traversal vulnerability exists in binary-husky/gpt_academic version git 310122f. The application supports the extraction of user-provided 7z files witho… |
CVE-2024-11170 | High | 8.8 | 2025-03-20 | A vulnerability in danny-avila/librechat version git 81f2936 allows for path traversal due to improper sanitization of file paths by the multer middleware. Thi… |
CVE-2024-10648 | High | 8.2 | 2025-03-20 | A path traversal vulnerability exists in the Gradio Audio component of gradio-app/gradio, as of version git 98cbcae. This vulnerability allows an attacker to c… |
CVE-2024-13059 | High | 7.2 | 2025-02-10 | A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer li… |
CVE-2024-51534 | High | 7.1 | 2025-02-01 | Dell PowerProtect DD versions prior to DDOS 8.3.0.0, 7.10.1.50, and 7.13.1.20 contain a path traversal vulnerability. A local low privileged could potentially… |
CVE-2024-21542 | High | 8.6 | 2024-12-10 | Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destination file path valid… |
CVE-2024-7962 | High | 7.5 | 2024-10-29 | An arbitrary file read vulnerability exists in gaizhenbiao/chuanhuchatgpt version 20240628 due to insufficient validation when loading prompt template files. A… |
CVE-2024-7774 | Critical | 9.1 | 2024-10-29 | A path traversal vulnerability exists in the `getFullPath` method of langchain-ai/langchainjs version 0.2.5. This vulnerability allows attackers to save files… |
CVE-2024-6394 | High | 7.5 | 2024-09-30 | A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8. The vulnerability is due to unverified path concatenation in the `ser… |
CVE-2024-6396 | Critical | 9.8 | 2024-07-12 | A vulnerability in the `_backup_run` function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate ar… |
CVE-2024-5926 | Critical | 9.1 | 2024-06-30 | A path traversal vulnerability in the get-project-files functionality of stitionai/devika allows attackers to read arbitrary files from the filesystem and caus… |
CVE-2024-6139 | High | 7.3 | 2024-06-27 | A path traversal vulnerability exists in the XTTS server of the parisneo/lollms package version v9.6. This vulnerability allows an attacker to write audio file… |
CVE-2024-4841 | Low | 3.3 | 2024-06-23 | A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input san… |
CVE-2024-5443 | Critical | 9.8 | 2024-06-22 | CVE-2024-4320 describes a vulnerability in the parisneo/lollms software, specifically within the `ExtensionBuilder().build_extension()` function. The vulnerabi… |
CVE-2024-21518 | High | 7.2 | 2024-06-22 | This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization… |
CVE-2024-5211 | High | 7.2 | 2024-06-12 | A path traversal vulnerability in mintplex-labs/anything-llm allowed a manager to bypass the `normalizePath()` function, intended to defend against path traver… |
CVE-2024-4320 | Critical | 9.8 | 2024-06-06 | A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@rou… |
CVE-2024-3429 | Critical | 9.8 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, specifically within the `sanitize_path_from_endpoint` and `sanitize_path` functions i… |
CVE-2024-2928 | High | 7.5 | 2024-06-06 | A Local File Inclusion (LFI) vulnerability was identified in mlflow/mlflow, specifically in version 2.9.2, which was fixed in version 2.11.3. This vulnerabilit… |
CVE-2024-2624 | Critical | 9.8 | 2024-06-06 | A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_persona… |
CVE-2024-2360 | Critical | 9.8 | 2024-06-06 | parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in… |
CVE-2024-2914 | High | 8.8 | 2024-06-06 | A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manip… |
CVE-2024-2178 | High | 7.5 | 2024-06-02 | A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_inf… |
CVE-2024-4322 | High | 7.5 | 2024-05-16 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `ca… |
CVE-2024-3848 | High | 7.5 | 2024-05-16 | A path traversal vulnerability exists in mlflow/mlflow version 2.11.0, identified as a bypass for the previously addressed CVE-2023-6909. The vulnerability ari… |
CVE-2024-3435 | High | 8.4 | 2024-05-16 | A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release bef… |
CVE-2024-2361 | Critical | 9.6 | 2024-05-16 | A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input. Specifically, t… |
CVE-2024-2358 | Critical | 9.8 | 2024-05-16 | A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises… |
CVE-2024-34470 | High | 8.6 | 2024-05-06 | An issue was discovered in HSC Mailinspector 5.2.17-3 through v.5.2.18. An Unauthenticated Path Traversal vulnerability exists in the /public/loader.php file… |
CVE-2024-3573 | Critical | 9.3 | 2024-04-16 | mlflow/mlflow is vulnerable to Local File Inclusion (LFI) due to improper parsing of URIs, allowing attackers to bypass checks and read arbitrary files on the… |
CVE-2024-2083 | Critical | 9.9 | 2024-04-16 | A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. Attackers can exploit this vulnera… |
CVE-2024-1561 | High | 7.5 | 2024-04-16 | An issue was discovered in gradio-app/gradio, where the `/component_server` endpoint improperly allows the invocation of any method on a `Component` class with… |
CVE-2023-6977 | High | 7.5 | 2023-12-20 | This vulnerability enables malicious users to read sensitive files on the server. |
CVE-2023-6975 | Critical | 9.8 | 2023-12-20 | A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information. |
CVE-2023-6909 | High | 7.5 | 2023-12-18 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-6831 | High | 8.1 | 2023-12-15 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.9.2. |
CVE-2023-6021 | High | 7.5 | 2023-11-16 | LFI in Ray's log API endpoint allows attackers to read any file on the server without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' re… |
CVE-2023-6023 | High | 7.5 | 2023-11-16 | An attacker can read any file on the filesystem on the server hosting ModelDB through an LFI in the artifact_path URL parameter. |
CVE-2023-6130 | High | 8.8 | 2023-11-14 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.14.2, 7.12.14, 8.4.2. |
CVE-2023-2984 | High | 8.8 | 2023-05-30 | Path Traversal: '\..\filename' in GitHub repository pimcore/pimcore prior to 10.5.22. |
CVE-2023-2780 | Critical | 9.8 | 2023-05-17 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.3.1. |
CVE-2023-1177 | Critical | 9.3 | 2023-03-24 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.
|
CVE-2023-1034 | High | 8.8 | 2023-02-25 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9. |
CVE-2023-0104 | Critical | 9.3 | 2023-02-22 |
The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker… |
CVE-2023-0316 | Medium | 5.5 | 2023-01-16 | Path Traversal: '\..\filename' in GitHub repository froxlor/froxlor prior to 2.0.0. |
CVE-2022-2788 | Low | 3.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, throu… |