Total
10917 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-60009 | 1 Eclipse | 1 Theia | 2026-10-24 | N/A | 8.8 HIGH |
| In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /file-upload` in every filesystem-enabled deployment. The handler takes an attacker-supplied absolute path from the multipart `uri` field and calls `fs.move(tmp, target, { overwrite: true })` with no workspace confinement and no authentication. In browser (non-Electron) deployments the connection token is enforced only on WebSocket upgrades; the HTTP middleware in `@theia/core` re-issues the cookie and calls `next()` without rejecting tokenless HTTP requests. Because `multipart/form-data` is a CORS-safelisted request type, a cross-origin web page can trigger the write with no preflight and no credentials, resulting in an unauthenticated arbitrary file write outside the workspace to any absolute path the backend process can write. This can escalate to remote code execution, for example by overwriting a startup-executed file such as `~/.bashrc`. Electron mode uses a separate `ElectronSecurityToken` and is not affected via this path. | |||||
| CVE-2026-70460 | 2026-10-24 | N/A | 8.1 HIGH | ||
| rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent. | |||||
| CVE-2026-62992 | 2026-10-24 | N/A | N/A | ||
| Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to 5.8.2 (and 4.5.7 on the 4.x line), Security::_checkDir() does not fully resolve symbolic links before validating that a requested path lies within a configured secure directory. An attacker able to place or reference a symlink within a directory Smarty treats as trusted (e.g., a template or config directory) could use it to point outside the intended secure directory, bypassing the containment check and reading arbitrary files accessible to the PHP process. This issue is fixed in versions 5.8.2 and 4.5.7. | |||||
| CVE-2026-47764 | 2026-10-24 | N/A | N/A | ||
| pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through write_to_fs. InstallDestination.write_to_fs() in src/pdm/installers/installers.py overrides the base class to add symlink/hardlink support but replaces the safe _path_with_destdir() (which validates via Path.resolve() + is_relative_to()) with a bare os.path.join() that performs no path validation. A malicious wheel with traversal entries can write arbitrary files. This issue has been fixed in version 2.27.0. | |||||
| CVE-2026-65768 | 1 Microsoft | 1 Teams | 2026-10-24 | N/A | 8.8 HIGH |
| Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-55747 | 2026-10-24 | N/A | 6.8 MEDIUM | ||
| The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected. | |||||
| CVE-2026-66384 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 5.3 MEDIUM |
| An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions. | |||||
| CVE-2026-65939 | 1 Progress | 1 Whatsup Gold | 2026-10-24 | N/A | 6.8 MEDIUM |
| In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile action specifying an arbitrary file extension within the IIS web root. | |||||
| CVE-2026-47612 | 2 Linux, Nvidia | 2 Linux Kernel, Dynamo | 2026-10-24 | N/A | 7.5 HIGH |
| NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker may cause improper limitation of a pathname to a restricted directory. A successful exploit of this vulnerability might lead to information disclosure. | |||||
| CVE-2026-69112 | 2026-10-24 | N/A | 7.1 HIGH | ||
| Hugging Face Accelerate through 1.14.0 contains a path traversal vulnerability in load_checkpoint_in_model and load_checkpoint_and_dispatch functions that fail to sanitize weight_map entries from sharded checkpoint indexes. Attackers can supply relative paths with ../ sequences or absolute paths to read arbitrary files, or point shard entries at named pipes to cause indefinite blocking and denial of service. | |||||
| CVE-2026-66382 | 1 Jfrog | 1 Artifactory | 2026-10-24 | N/A | 4.3 MEDIUM |
| An authenticated user may write files outside the intended Artifactory work directory under specific conditions. | |||||
| CVE-2026-67613 | 2026-10-24 | N/A | 4.9 MEDIUM | ||
| CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON request body, which is passed directly to open() in cloudManager.py without validation or allowlisting, enabling traversal to any file readable by the root-privileged CyberPanel process including credential files, SSL and SSH private keys, and JWT secret files. | |||||
| CVE-2026-66492 | 2026-10-24 | N/A | N/A | ||
| Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the file upload action lead to path a traversal vulnerability. | |||||
| CVE-2026-66491 | 2026-10-24 | N/A | N/A | ||
| Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths in the getSource function lead to an arbitrary file read vulnerability. | |||||
| CVE-2026-58072 | 2026-10-24 | N/A | N/A | ||
| A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management server, which can lead to remotecode execution. | |||||
| CVE-2026-61980 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions. | |||||
| CVE-2026-65582 | 2026-10-24 | N/A | 7.7 HIGH | ||
| Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions. | |||||
| CVE-2026-53976 | 2026-10-24 | N/A | 9.1 CRITICAL | ||
| OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unauthenticated remote attackers to read arbitrary files by supplying the allowOutsideWorkspace=true query parameter alongside an absolute path, bypassing the workspace boundary check in resolveReadPathFromContext. Attackers can exploit the vacuous isPathWithinRoot guard to read sensitive files such as the JWT signing secret, SSH private keys, API credentials, and environment variables, enabling full authentication bypass by forging session cookies on password-protected deployments. | |||||
| CVE-2026-47487 | 2 Linux, Nvidia | 2 Linux Kernel, Triton Inference Server | 2026-10-24 | N/A | 4.4 MEDIUM |
| NVIDIA Triton Inference Server for Linux contains a vulnerability where a user could cause files outside the model repository to be read, written to, or modified by providing a path in the model name to the Triton MLflow plugin. A successful exploit of this vulnerability might lead to denial of service and information disclosure. | |||||
| CVE-2026-66777 | 1 Sap | 1 Approuter | 2026-10-24 | N/A | 5.9 MEDIUM |
| SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker with low privileges could send specially crafted requests to bypass authorization checks and reach protected resources beyond their assigned scope. Successful exploitation could allow the attacker to read sensitive data and perform limited modifications on protected resources, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability. | |||||