Total
10238 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-37129 | 1 Dell | 1 Inventory Collector | 2026-07-24 | N/A | 6.7 MEDIUM |
| Dell Inventory Collector, versions prior to 12.3.0.6 contains a Path Traversal vulnerability. A local authenticated malicious user could potentially exploit this vulnerability, leading to arbitrary code execution on the system. | |||||
| CVE-2026-41917 | 2026-07-24 | N/A | 4.9 MEDIUM | ||
| OpenKM 6.3.12 contains a local file inclusion vulnerability in the administrative scripting interface at /admin/Scripting that allows authenticated administrators to read arbitrary files by supplying an attacker-controlled filesystem path through the fsPath parameter with action=Load. Attackers can exploit this to access sensitive files including /etc/passwd, configuration files containing database credentials, and JVM keystores accessible to the OpenKM process. | |||||
| CVE-2018-25393 | 2026-07-24 | N/A | 6.5 MEDIUM | ||
| Navigate CMS 2.8.5 contains a path traversal vulnerability that allows authenticated users to download arbitrary files by injecting directory traversal sequences in the id parameter. Attackers can send GET requests to navigate_download.php with path traversal payloads ../../../cfg/globals.php to access sensitive configuration files and system files outside the intended directory. | |||||
| CVE-2026-36829 | 2026-07-24 | N/A | 9.8 CRITICAL | ||
| An authentication bypass vulnerability exists in the embedded HTTP server of Panabit PAP-XM320 up to and including v7.7. The server validates session cookies using a filesystem existence check based on a user-controlled cookie value without proper sanitization, allowing directory traversal and bypass of authentication. | |||||
| CVE-2026-12198 | 2026-07-24 | 7.5 HIGH | 7.3 HIGH | ||
| A weakness has been identified in Microweber up to 2.0.20. This affects the function userfiles_path of the file /api_nosession/thumbnail_img of the component API Endpoint. Executing a manipulation of the argument cache_path_relative can lead to path traversal. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-12211 | 2026-07-24 | 3.3 LOW | 2.7 LOW | ||
| A flaw has been found in Intelbras iNVU 7016 FT 3.004.00IB000.0.T Build 2025-09-26. This impacts an unknown function of the file /RPC2_Loadfile/syslog/ of the component Web Interface. Executing a manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. It is recommended to upgrade the affected component. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product. | |||||
| CVE-2025-70950 | 2026-07-24 | N/A | 7.3 HIGH | ||
| An issue in gohttp commit 34ea51 allows attackers to execute a directory traversal via supplying a crafted request. | |||||
| CVE-2026-44788 | 1 Adamhathcock | 1 Sharpcompress | 2026-07-24 | N/A | 5.9 MEDIUM |
| SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process. | |||||
| CVE-2026-43982 | 2026-07-24 | N/A | N/A | ||
| Algernon is a small self-contained pure-Go web server. Prior to 1.17.6, uploadedFileSaveIn() in lua/upload/upload.go uses filepath.Join() with the caller-supplied directory but performs no boundary check after joining. A directory of ../../../tmp resolves cleanly to /tmp, outside the web root. This vulnerability is fixed in 1.17.6. | |||||
| CVE-2026-40383 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 9.8 CRITICAL |
| An improper validation of user-supplied input leads to a local file inclusion vulnerability. | |||||
| CVE-2026-42448 | 2026-07-24 | N/A | 3.5 LOW | ||
| Magic Wormhole makes it possible to get arbitrary-sized files and directories from one computer to another. Prior to 0.24.0, there is a path traversal when a receiver who specifies "--output <dir>" where that output directory currently exists (as a directory). This vulnerability is fixed in 0.24.0. | |||||
| CVE-2026-40384 | 1 Joomla | 1 Joomla\! | 2026-07-24 | N/A | 7.5 HIGH |
| An improper validation of the search parameter of the com_media files API endpoint leads to a path traversal vulnerability. | |||||
| CVE-2026-48126 | 2026-07-24 | N/A | 8.2 HIGH | ||
| Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8. | |||||
| CVE-2026-42496 | 1 Archive\ | 1 \ | 2026-07-24 | N/A | 9.1 CRITICAL |
| Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory. _make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target. A subsequent open through the extracted name reads or writes the attacker chosen path. | |||||
| CVE-2026-24208 | 2 Linux, Nvidia | 2 Linux Kernel, Triton Inference Server | 2026-07-24 | N/A | 5.3 MEDIUM |
| NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service. | |||||
| CVE-2026-24209 | 2 Linux, Nvidia | 2 Linux Kernel, Triton Inference Server | 2026-07-24 | N/A | 7.5 HIGH |
| NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a path traversal issue. A successful exploit of this vulnerability might lead to denial of service. | |||||
| CVE-2018-25374 | 2026-07-24 | N/A | 7.5 HIGH | ||
| Softneta MedDream PACS Server Premium 6.7.1.1 contains a directory traversal vulnerability that allows unauthenticated attackers to read arbitrary files by manipulating the path parameter. Attackers can send requests to nocache.php with encoded backslash sequences to traverse directories and access sensitive files including system configuration and password files. | |||||
| CVE-2026-35593 | 2026-07-24 | N/A | 6.8 MEDIUM | ||
| Trilium Notes is an open-source, cross-platform hierarchical note taking application for building large personal knowledge bases. Versions 0.102.1 and prior are vulnerable to Local File Inclusion, allowing an authenticated attacker to read sensitive arbitrary files from the server's filesystem. The uploadModifiedFileToAttachment function, which is called when a POST request is received to /api/attachments/{attachmentId}/upload-modified-file, replaces the content of the attachment with the content from another file (whose path is provided in filePath of Request body). After which the content of the attachment can be viewed at /api/attachments/{attachmentId}/download. This exposes sensitive system files such as SSH keys, credentials, configs, and OS files, potentially leading to remote code execution and compromise of co-hosted applications. This issue has been fixed in version 0.102.2. | |||||
| CVE-2026-7214 | 2026-07-24 | 7.5 HIGH | 7.3 HIGH | ||
| A vulnerability was identified in eghuzefa engineer-your-data up to 0.1.3. This vulnerability affects the function read_file/write_file/list_files/file_inf of the file src/server.py. The manipulation of the argument WORKSPACE_PATH leads to path traversal. The attack may be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-8215 | 2026-07-24 | 5.0 MEDIUM | 5.3 MEDIUM | ||
| A vulnerability was determined in Industrial Application Software IAS Canias ERP 8.03. This vulnerability affects the function iasRequestFileEvent of the component RMI Interface. This manipulation of the argument m_strSourceFileName causes path traversal. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | |||||