Total
10966 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-28981 | 1 Liferay | 1 Liferay Portal | 2026-07-09 | N/A | 7.5 HIGH |
| Path traversal vulnerability in the Hypermedia REST APIs module in Liferay Portal 7.4.0 through 7.4.2 allows remote attackers to access files outside of com.liferay.headless.discovery.web/META-INF/resources via the `parameter` parameter. | |||||
| CVE-2022-28945 | 1 Webbank | 1 Webcube | 2026-07-09 | 7.5 HIGH | 9.8 CRITICAL |
| An issue in Webbank WeCube v3.2.2 allows attackers to execute a directory traversal via a crafted ZIP file. | |||||
| CVE-2022-24992 | 1 Qr Code Generator Project | 1 Qr Code Generator | 2026-07-09 | N/A | 7.5 HIGH |
| A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal. | |||||
| CVE-2022-23347 | 1 Bigantsoft | 1 Bigant Server | 2026-07-09 | 5.0 MEDIUM | 7.5 HIGH |
| BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks. | |||||
| CVE-2022-22914 | 1 Ovidentia | 1 Ovidentia | 2026-07-09 | 5.0 MEDIUM | 7.5 HIGH |
| An incorrect access control issue in the component FileManager of Ovidentia CMS 6.0 allows authenticated attackers to to view and download content in the upload directory via path traversal. | |||||
| CVE-2021-45783 | 1 Bookeen | 2 Notea, Notea Firmware | 2026-07-09 | 2.1 LOW | 4.6 MEDIUM |
| Bookeen Notea Firmware BK_R_1.0.5_20210608 is affected by a directory traversal vulnerability that allows an attacker to obtain sensitive information. | |||||
| CVE-2021-45418 | 1 Starcharge | 4 Nova 360 Cabinet, Nova 360 Cabinet Firmware, Titan 180 Premium and 1 more | 2026-07-09 | 6.5 MEDIUM | 8.8 HIGH |
| Certain Starcharge products are vulnerable to Directory Traversal via main.cgi. The affected products include: Nova 360 Cabinet <=1.3.0.0.6 - Fixed: 1.3.0.0.9 and Titan 180 Premium <=1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0. | |||||
| CVE-2021-44674 | 1 Opmantek | 1 Open-audit | 2026-07-09 | 4.0 MEDIUM | 6.5 MEDIUM |
| An information exposure issue has been discovered in Opmantek Open-AudIT 4.2.0. The vulnerability allows an authenticated attacker to read file outside of the restricted directory. | |||||
| CVE-2021-41449 | 1 Netgear | 6 Rax35, Rax35 Firmware, Rax38 and 3 more | 2026-07-09 | 3.6 LOW | 7.1 HIGH |
| A path traversal attack in web interfaces of Netgear RAX35, RAX38, and RAX40 routers before v1.0.4.102, allows a remote unauthenticated attacker to gain access to sensitive restricted information, such as forbidden files of the web application, via sending a specially crafted HTTP packet. | |||||
| CVE-2021-37500 | 1 Reprisesoftware | 1 Reprise License Manager | 2026-07-09 | N/A | 8.1 HIGH |
| Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM users with sufficient privileges to overwrite any file the on the server. | |||||
| CVE-2021-29006 | 1 Rconfig | 1 Rconfig | 2026-07-09 | 4.0 MEDIUM | 6.5 MEDIUM |
| rConfig 3.9.6 is affected by a Local File Disclosure vulnerability. An authenticated user may successfully download any file on the server. | |||||
| CVE-2021-27328 | 1 Yeastar | 2 Neogate Tg400, Neogate Tg400 Firmware | 2026-07-09 | 4.0 MEDIUM | 6.5 MEDIUM |
| Yeastar NeoGate TG400 91.3.0.3 devices are affected by Directory Traversal. An authenticated user can decrypt firmware and can read sensitive information, such as a password or decryption key. | |||||
| CVE-2024-41628 | 2026-07-09 | N/A | 7.5 HIGH | ||
| Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API. | |||||
| CVE-2020-26037 | 1 Evenbalance | 1 Punkbuster | 2026-07-09 | N/A | 9.8 CRITICAL |
| Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows remote attackers to execute arbitrary code. | |||||
| CVE-2020-22623 | 1 Insightsoftware | 1 Jreport | 2026-07-09 | N/A | 7.5 HIGH |
| Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information. | |||||
| CVE-2017-15684 | 1 Craftercms | 1 Crafter Cms | 2026-07-09 | 5.0 MEDIUM | 7.5 HIGH |
| Crafter CMS Crafter Studio 3.0.1 has a directory traversal vulnerability which allows unauthenticated attackers to view files from the operating system. | |||||
| CVE-2017-15681 | 1 Craftercms | 1 Crafter Cms | 2026-07-09 | 7.5 HIGH | 9.8 CRITICAL |
| In Crafter CMS Crafter Studio 3.0.1 a directory traversal vulnerability exists which allows unauthenticated attackers to overwrite files from the operating system which can lead to RCE. | |||||
| CVE-2026-55874 | 2026-07-08 | N/A | 7.7 HIGH | ||
| SeaweedFS is a distributed storage system. Prior to 4.34, the S3 API gateway does not reject dot-dot path segments in the X-Amz-Copy-Source header used by CopyObject and UploadPartCopy, allowing an authenticated identity scoped to one bucket to read objects from other buckets through server-side copy. This issue is fixed in version 4.34. | |||||
| CVE-2026-55668 | 2026-07-08 | N/A | 6.3 MEDIUM | ||
| File Browser provides a web file managing interface. Prior to 2.63.16, ScopedFs validates the nearest existing ancestor of a dangling symlink as in scope and then follows the symlink during file creation, allowing an authenticated user with Create and Modify permissions to create attacker-controlled files outside the user's scope. This issue is fixed in version 2.63.16. | |||||
| CVE-2026-14500 | 2026-07-08 | N/A | 5.3 MEDIUM | ||
| The Bulk Order Update for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 1.6. This is due to the bouw_fetch_csv_data() AJAX handler being registered on the wp_ajax_nopriv_ hook with no capability or nonce check, and passing the attacker-supplied csv_url POST parameter — filtered only by esc_url_raw() (which leaves absolute filesystem paths intact) and validate_file() (which only rejects '..' traversal patterns) — directly into fopen()/fgetcsv() and reflecting the first parsed line in the JSON response. This makes it possible for unauthenticated attackers to read the first line of arbitrary files on the server (such as /etc/passwd) and to use the handler as a file-existence oracle. | |||||