CVE-2026-47243 | | | 2026-08-07 | Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. Prior to 3… |
CVE-2026-54202 | | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the
archive creation functionality. Because the archive path is
… |
CVE-2026-61891 | High | 7.5 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP file-download endpoints (`GET /file`, `GET /files/`, `PUT /f… |
CVE-2026-13346 | | | 2026-07-29 | pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wh… |
CVE-2026-13189 | High | 7.5 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, insufficient validation of the language parameter in the spell check handler may allow an attacker to i… |
CVE-2026-57211 | Medium | 6.5 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbit_mgmt_wm_static ca… |
CVE-2026-15302 | Medium | 5.3 | 2026-07-10 | The ARMember plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.27 via the 'X-FILENAME' HTTP header. This make… |
CVE-2026-58300 | Medium | 6.2 | 2026-07-03 | Absolute path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally. |
CVE-2026-49290 | | | 2026-06-19 | Slopsmith is a self-contained web application for browsing, playing, and practicing Rocksmith 2014 Custom DLC (CDLC). Prior to 0.2.9-alpha.5, a path-traversal… |
CVE-2026-53698 | Medium | 6.5 | 2026-06-10 | Silverpeas through 6.4.6 mishandles the "Personal space" feature that is selected when no componentId is set. |
CVE-2026-10075 | Medium | 5.3 | 2026-05-29 | DreamMaker developed by Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to read file names under arbitrary path by expl… |
CVE-2026-10044 | High | 7.5 | 2026-05-28 | Usagi-org ai-goofish-monitor contains an unauthenticated arbitrary file read vulnerability in the GET /api/prompts/{filename} endpoint on Windows deployments t… |
CVE-2026-32997 | | | 2026-05-28 | A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Replication server. |
CVE-2026-4782 | Medium | 6.5 | 2026-05-13 | The Avada Builder plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.15.2 via the 'fusion_get_svg_from_file' fun… |
CVE-2026-32175 | Medium | 4.3 | 2026-05-12 | A tampering vulnerability exists when .NET Core improperly handles specially crafted files. An attacker who successfully exploited this vulnerability could wri… |
CVE-2026-42315 | High | 8.1 | 2026-05-11 | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, when passing a folder name in the set_package_data() API function… |
CVE-2026-6418 | Medium | 4.9 | 2026-05-05 | An issue was discovered in the Shared Account Synchronization component of PaperCut MF (version 25.0.4). The application allows administrative users to configu… |
CVE-2026-44029 | Medium | 5.3 | 2026-05-05 | An issue was discovered in Nix before 2.34.7. Writing to arbitrary files can occur via "nix-prefetch-url --unpack" or "nix store prefetch-file --unpack" direct… |
CVE-2026-7217 | Medium | 5.3 | 2026-04-28 | A security vulnerability has been detected in Deepractice PromptX up to 2.4.0. The affected element is the function read_docx/read_xlsx/read_pptx/list_xlsx_she… |
CVE-2026-35465 | High | 7.5 | 2026-04-18 | SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17… |
CVE-2026-34515 | High | 7.5 | 2026-04-01 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose info… |
CVE-2026-4373 | High | 7.5 | 2026-03-21 | The JetFormBuilder plugin for WordPress is vulnerable to arbitrary file read via path traversal in all versions up to, and including, 3.5.6.2. This is due to t… |
CVE-2026-0846 | High | 7.5 | 2026-03-09 | A vulnerability in the `filestring()` function of the `nltk.util` module in nltk version 3.9.2 allows arbitrary file read due to improper validation of input p… |
CVE-2026-2753 | High | 7.5 | 2026-03-06 | An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path in… |
CVE-2026-28414 | High | 7.5 | 2026-02-27 | Gradio is an open-source Python package designed for quick prototyping. Prior to version 6.7, Gradio apps running on Window with Python 3.13+ are vulnerable to… |
CVE-2026-27117 | Medium | 5.5 | 2026-02-24 | bit7z is a cross-platform C++ static library that allows the compression/extraction of archive files. Prior to version 4.0.11, a path traversal vulnerability (… |
CVE-2026-26337 | High | 8.2 | 2026-02-19 | Hyland Alfresco Transformation Service allows unauthenticated attackers to achieve both arbitrary file read and server-side request forgery through the absolut… |
CVE-2026-1330 | High | 7.5 | 2026-01-22 | MeetingHub developed by HAMASTAR Technology has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Traver… |
CVE-2026-20834 | Medium | 4.6 | 2026-01-13 | Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. |
CVE-2025-68472 | High | 8.1 | 2026-01-12 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload… |
CVE-2025-15237 | Medium | 4.3 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder name… |
CVE-2025-15236 | Medium | 4.3 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder name… |
CVE-2025-15227 | High | 7.5 | 2025-12-29 | BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Absolute Path Trav… |
CVE-2025-14848 | Medium | 4.3 | 2025-12-18 | Advantech WebAccess/SCADA
is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. |
CVE-2025-67898 | Medium | 4.5 | 2025-12-14 | MJML through 4.18.0 allows mj-include directory traversal to test file existence and (in the type="css" case) read files. NOTE: this issue exists because of an… |
CVE-2025-34392 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL tha… |
CVE-2025-14253 | Medium | 4.9 | 2025-12-08 | Vitals ESP developed by Galaxy Software Services has an Arbitrary File Read vulnerability, allowing privileged remote attackers to exploit Absolute Path Traver… |
CVE-2025-36357 | High | 8.0 | 2025-11-17 | IBM Planning Analytics Local 2.1.0 through 2.1.14 could allow a remote authenticated user to traverse directories on the system. An attacker could send a speci… |
CVE-2025-13283 | High | 7.1 | 2025-11-17 | TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provi… |
CVE-2025-13282 | High | 8.1 | 2025-11-17 | TenderDocTransfer developed by Chunghwa Telecom has a Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs… |
CVE-2025-7846 | High | 8.8 | 2025-10-31 | The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the save_fields() fun… |
CVE-2025-8575 | High | 7.2 | 2025-09-12 | The LWS Cleaner plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'lws_cl_delete_file' function in… |
CVE-2025-9518 | High | 7.2 | 2025-09-04 | The atec Debug plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation on the 'debug_path' parameter in all vers… |
CVE-2025-9516 | Medium | 4.9 | 2025-09-04 | The atec Debug plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 1.2.22 via the 'custom_log' parameter. This make… |
CVE-2025-9259 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9258 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9257 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-9256 | Medium | 6.5 | 2025-08-22 | WebITR developed by Uniong has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Absolute Path Traversal to… |
CVE-2025-57790 | High | 8.8 | 2025-08-20 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. The vulner… |
CVE-2025-8912 | High | 7.5 | 2025-08-13 | Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to exploit Absolute P… |
CVE-2025-8909 | Medium | 6.5 | 2025-08-13 | Organization Portal System developed by WellChoose has an Arbitrary File Reading vulnerability, allowing remote attackers with regular privileges to exploit Ab… |
CVE-2025-8213 | High | 7.2 | 2025-07-31 | The NinjaScanner – Virus & Malware scan plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'nscan_aj… |
CVE-2025-53079 | Medium | 4.9 | 2025-07-29 | Absolute Path Traversal in Samsung DMS(Data Management Server) allows authenticated attacker (Administrator) to read sensitive files |
CVE-2025-8009 | Medium | 4.9 | 2025-07-24 | The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242… |
CVE-2025-53651 | Medium | 6.3 | 2025-07-09 | Jenkins HTML Publisher Plugin 425 and earlier displays log messages that include the absolute paths of files archived during the Publish HTML reports post-buil… |
CVE-2025-53392 | Medium | 5.0 | 2025-06-28 | In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE… |
CVE-2025-6381 | High | 8.8 | 2025-06-28 | The BeeTeam368 Extensions plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.4 via the handle_remove_temp_file… |
CVE-2025-5927 | High | 7.5 | 2025-06-25 | The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() func… |
CVE-2025-4799 | High | 7.2 | 2025-06-11 | The WP-DownloadManager plugin for WordPress is vulnerable to arbitrary file deletion due to lack of restriction on the directory a file can be deleted from in… |
CVE-2025-36574 | High | 8.2 | 2025-06-10 | Dell Wyse Management Suite, versions prior to WMS 5.2, contain an Absolute Path Traversal vulnerability. An unauthenticated attacker with remote access could p… |
CVE-2024-13945 | Medium | 6.0 | 2025-05-23 | Stored Absolute Path Traversal vulnerabilities in ASPECT could expose sensitive data
if administrator credentials become compromised.
This issue affects ASPE… |
CVE-2024-48850 | High | 7.2 | 2025-05-22 | Absolute File Traversal vulnerabilities in ASPECT allows access and modification of unintended resources.
This issue affects ASPECT-Enterprise: through 3.08.03… |
CVE-2025-46822 | | | 2025-05-21 | OsamaTaher/Java-springboot-codebase is a collection of Java and Spring Boot code snippets, applications, and projects. Prior to commit c835c6f7799eacada4c0fc77… |
CVE-2024-8501 | High | 8.8 | 2025-03-20 | An arbitrary file download vulnerability exists in the rpc_agent_client component of modelscope/agentscope version v0.0.4. This vulnerability allows any user t… |
CVE-2024-6854 | High | 7.1 | 2025-03-20 | In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in t… |
CVE-2024-12375 | Medium | 6.5 | 2025-03-20 | A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version git 82a973c. This vulnerability allows an attack… |
CVE-2024-10833 | Critical | 9.1 | 2025-03-20 | eosphoros-ai/db-gpt version 0.6.0 is vulnerable to an arbitrary file write through the knowledge API. The endpoint for uploading files as 'knowledge' is suscep… |
CVE-2024-10831 | Critical | 9.1 | 2025-03-20 | In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to uploa… |
CVE-2024-10047 | Medium | 5.3 | 2025-03-20 | parisneo/lollms-webui versions v9.9 to the latest are vulnerable to a directory listing vulnerability. An attacker can list arbitrary directories on a Windows… |
CVE-2024-48248 | High | 8.6 | 2025-03-04 | NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code… |
CVE-2025-0001 | Medium | 6.5 | 2025-02-17 | Abacus ERP is versions older than 2024.210.16036, 2023.205.15833, 2022.105.15542 are affected by an authenticated arbitrary file read vulnerability. |
CVE-2024-6097 | Medium | 5.3 | 2025-02-12 | In Progress® Telerik® Reporting versions prior to 2025 Q1 (19.0.25.211), information disclosure is possible by a local threat actor through an absolute path vu… |
CVE-2024-57966 | Medium | 5.0 | 2025-02-03 | libarchiveplugin.cpp in KDE ark before 24.12.0 can extract to an absolute path from an archive. |
CVE-2025-0851 | Critical | 9.8 | 2025-01-29 | A path traversal issue in ZipUtils.unzip and TarUtils.untar in Deep Java Library (DJL) on all platforms allows a bad actor to write files to arbitrary location… |
CVE-2024-13161 | Critical | 9.8 | 2025-01-14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at… |
CVE-2024-13160 | Critical | 9.8 | 2025-01-14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at… |
CVE-2024-13159 | Critical | 9.8 | 2025-01-14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at… |
CVE-2024-10811 | Critical | 9.8 | 2025-01-14 | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated at… |
CVE-2024-56321 | Low | 3.8 | 2025-01-03 | GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 (inclusive) can allow GoCD admins to abuse the backup configuration "post-backup scrip… |
CVE-2024-12646 | High | 8.1 | 2024-12-16 | The topm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for commu… |
CVE-2024-12644 | High | 7.1 | 2024-12-16 | The tbm-client from Chunghwa Telecom has an Arbitrary File vulnerability. The application sets up a simple local web server and provides APIs for communication… |
CVE-2024-12643 | High | 8.1 | 2024-12-16 | The tbm-client from Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for commun… |
CVE-2024-51549 | Critical | 10.0 | 2024-12-05 | Absolute File Traversal vulnerabilities allows access and modification of un-intended resources.
Affected products:
ABB ASPECT - Enterprise v3.08.02;
NEXU… |
CVE-2024-11978 | High | 7.5 | 2024-11-29 | DreamMaker from Interinfo has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system… |
CVE-2024-10651 | Medium | 4.9 | 2024-11-01 | IDExpert from CHANGING Information Technology does not properly validate a specific parameter in the administrator interface, allowing remote attackers with ad… |
CVE-2024-47883 | Critical | 9.1 | 2024-10-24 | The OpenRefine fork of the MIT Simile Butterfly server is a modular web application framework. The Butterfly framework uses the `java.net.URL` class to refer t… |
CVE-2024-20379 | Medium | 6.5 | 2024-10-23 | A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software, formerly Firepower Management Center Software… |
CVE-2024-9924 | Critical | 9.8 | 2024-10-14 | The fix for CVE-2024-26261 was incomplete, and and the specific package for OAKlouds from Hgiga remains at risk. Unauthenticated remote attackers still can dow… |
CVE-2024-45291 | Medium | 6.3 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file that links images from… |
CVE-2024-45290 | High | 7.7 | 2024-10-07 | PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. It's possible for an attacker to construct an XLSX file which links media from… |
CVE-2024-8497 | High | 7.5 | 2024-09-25 | Franklin Fueling Systems TS-550 EVO versions prior to 2.26.4.8967 possess a file that can be read arbitrarily that could allow an attacker obtain administrator… |
CVE-2024-8778 | Medium | 6.5 | 2024-09-16 | OMFLOW from The SYSCOM Group does not properly validate user input of the download functionality, allowing remote attackers with regular privileges to read arb… |
CVE-2024-7323 | Medium | 6.5 | 2024-08-02 | Digiwin EasyFlow .NET lacks proper access control for specific functionality, and the functionality do not adequately filter user input. A remote attacker with… |
CVE-2024-28806 | High | 7.5 | 2024-07-29 | An issue was discovered in Italtel i-MCS NFV 12.1.0-20211215. Remote unauthenticated attackers can upload files at an arbitrary path. |
CVE-2024-20401 | Critical | 9.8 | 2024-07-17 | A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwri… |
CVE-2024-6250 | High | 7.5 | 2024-06-27 | An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py`. The `sanitize_… |
CVE-2024-33620 | High | 8.6 | 2024-06-18 | Absolute path traversal vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, the file contents includ… |
CVE-2024-4881 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms application, affecting version 9.4.0 and potentially earlier versions, but fixed in version 5.9.0… |
CVE-2024-2548 | High | 7.5 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_fil… |
CVE-2024-2362 | Critical | 9.1 | 2024-06-06 | A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Window… |