Total
10975 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-7311 | 2026-07-06 | N/A | 8.1 HIGH | ||
| The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and including, 3.6.13. This makes it possible for authenticated attackers, with author-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). An attacker can exploit this by injecting an arbitrary server file path into the 'convert.path' field of the 'tiny_compress_images' post meta on an attachment they own, then triggering attachment deletion to invoke the vulnerable code path. | |||||
| CVE-2026-14327 | 2026-07-06 | N/A | 7.5 HIGH | ||
| The AR for WordPress plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 8.40 via the 'file' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires an attacker to first obtain a valid nonce and secure nonce via the publicly accessible ar_get_fresh_nonce and ar_process_user_image nopriv AJAX handlers, and to reproduce the encryption key locally — both steps are fully achievable by an unauthenticated attacker on any default free or unlicensed installation where ar_licence_key is unset. | |||||
| CVE-2026-28701 | 1 Daktronics | 6 Dmp-5000, Dmp-5000 Firmware, Dmp-8000 and 3 more | 2026-07-06 | N/A | 9.8 CRITICAL |
| Various versions of Daktronics Controller Firmware could allow authenticated and unauthenticated remote users to escape the intended directory and enumerate arbitrary file system paths. | |||||
| CVE-2026-30462 | 2026-07-05 | N/A | 4.3 MEDIUM | ||
| A path traversal vulnerability in the Blocks module of Daylight Studio FuelCMS v1.5.2 allows attackers to execute a directory traversal. | |||||
| CVE-2025-60969 | 1 Endruntechnologies | 2 Sonoma D12, Sonoma D12 Firmware | 2026-07-05 | N/A | 5.7 MEDIUM |
| Directory Traversal vulnerability in EndRun Technologies Sonoma D12 Network Time Server (GPS) F/W 6010-0076-000 Ver 4.00 allows attackers to gain sensitive information. | |||||
| CVE-2025-22205 | 1 Admiror-design-studio | 1 Admiror Gallery | 2026-07-05 | N/A | 7.5 HIGH |
| Improper handling of input variables lead to multiple path traversal vulnerabilities in the Admiror Gallery extension for Joomla in version branch 4.x. | |||||
| CVE-2024-48735 | 2026-07-05 | N/A | 7.7 HIGH | ||
| Directory Traversal in /SASStudio/sasexec/sessions/{sessionID}/workspace/{InternalPath} in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized users. | |||||
| CVE-2025-69621 | 2026-07-05 | N/A | 8.1 HIGH | ||
| An arbitrary file overwrite vulnerability in the file import process of Comic Book Reader v1.0.95 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information. | |||||
| CVE-2025-69620 | 1 Ntoolslab | 1 Office Reader | 2026-07-05 | N/A | 5.0 MEDIUM |
| A path traversal in Moo Chan Song v4.5.7 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage. | |||||
| CVE-2025-69619 | 1 Zipperapp | 1 My Teditor | 2026-07-05 | N/A | 5.5 MEDIUM |
| A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage. | |||||
| CVE-2025-69618 | 1 Coto.world | 1 Coto | 2026-07-05 | N/A | 6.5 MEDIUM |
| An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, potentially leading to arbitrary code execution or exposure of sensitive information. | |||||
| CVE-2025-69612 | 1 Tmsglobalsoft | 1 Tms Management Console | 2026-07-05 | N/A | 6.5 MEDIUM |
| A path traversal vulnerability exists in TMS Management Console (version 6.3.7.27386.20250818) from TMS Global Software. The "Download Template" function in the profile dashboard does not neutralize directory traversal sequences (../) in the filePath parameter, allowing authenticated users to read arbitrary files, such as the server's Web.config. | |||||
| CVE-2025-67160 | 1 Vatilon | 2 Pa4, Pa4 Firmware | 2026-07-05 | N/A | 7.5 HIGH |
| An issue in Vatilon v1.12.37-20240124 allows attackers to access sensitive directories and files via a directory traversal. | |||||
| CVE-2025-25800 | 1 Seacms | 1 Seacms | 2026-07-05 | N/A | 5.3 MEDIUM |
| SeaCMS 13.3 was discovered to contain an arbitrary file read vulnerability in the file_get_contents function at admin_safe_file.php. | |||||
| CVE-2024-55401 | 1 4cstrategies | 1 Exonaut | 2026-07-05 | N/A | 6.5 MEDIUM |
| An issue in 4C Strategies Exonaut before v22.4 allows attackers to execute a directory traversal. | |||||
| CVE-2024-51127 | 1 Redhat | 1 Hornetq | 2026-07-05 | N/A | 7.1 HIGH |
| An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information. | |||||
| CVE-2024-46446 | 1 Mecha-cms | 1 Mecha | 2026-07-05 | N/A | 9.8 CRITICAL |
| Mecha CMS 3.0.0 is vulnerable to Directory Traversal. An attacker can construct cookies and URIs that bypass user identity checks. Parameters can then be passed through the POST method, resulting in the Deletion of Arbitrary Files or Website Takeover. | |||||
| CVE-2024-33109 | 2 Ergophone, Yealink | 4 Tiptel Ip 286, Tiptel Ip 286 Firmware, Sip-t28p and 1 more | 2026-07-05 | N/A | 9.9 CRITICAL |
| Directory Traversal in the web interface of the Tiptel IP 286 with firmware version 2.61.13.10 allows attackers to overwrite arbitrary files on the phone via the Ringtone upload function. | |||||
| CVE-2021-37293 | 1 Kevinlab | 1 4st L-bems | 2026-07-05 | 4.0 MEDIUM | 6.5 MEDIUM |
| A Directory Traversal vulnerability exists in KevinLAB Inc Building Energy Management System 4ST BEMS 1.0.0 via the page GET parameter in index.php. | |||||
| CVE-2026-5051 | 2026-07-02 | N/A | 4.4 MEDIUM | ||
| HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability (CVE-2026-5051) is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17. | |||||