Total
10928 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-67819 | 1 Weaviate | 1 Weaviate | 2026-10-14 | N/A | 4.9 MEDIUM |
| An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the GetFile method while a shard is in the "Pause file activity" state and the FileReplicationService is reachable can read arbitrary files accessible to the service process. | |||||
| CVE-2025-13972 | 2026-10-14 | N/A | 4.9 MEDIUM | ||
| The WatchTowerHQ plugin for WordPress is vulnerable to arbitrary file read via the 'wht_download_big_object_origin' parameter in all versions up to, and including, 3.16.0. This is due to insufficient path validation in the handle_big_object_download_request function. This makes it possible for authenticated attackers, with administrator-level access and a valid access token, to read arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys. | |||||
| CVE-2025-67818 | 1 Weaviate | 1 Weaviate | 2026-10-14 | N/A | 7.2 HIGH |
| An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (e.g., /etc/...) or use parent directory traversal (../../..) to escape the restore root when a backup is restored, potentially creating or overwriting files in arbitrary locations within the application's privilege scope. | |||||
| CVE-2026-108585 | 2026-10-14 | N/A | 5.4 MEDIUM | ||
| argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients to reach unintended API endpoints via unvalidated applicationName values. Attackers or prompt-injected models can supply dot-segment values like ../repositories/ to send authenticated DELETE requests deleting repositories, clusters, or projects within the token's RBAC permissions. | |||||
| CVE-2026-108158 | 2026-10-14 | N/A | 6.5 MEDIUM | ||
| plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting participant to read server files via crafted filePath values. Attackers can supply ../ sequences so text or office documents are converted into page images, then fetch them unauthenticated through /download/uploadedFile/. | |||||
| CVE-2026-93347 | 2026-10-14 | N/A | 4.9 MEDIUM | ||
| Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to read arbitrary files via unvalidated filename values. Attackers holding the cluster key can send DistributedAPI requests with traversal filenames to read client.keys, ossec.conf with the cluster key, and other wazuh-readable files. | |||||
| CVE-2026-107508 | 2026-10-14 | N/A | 8.6 HIGH | ||
| The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unauthenticated attackers to include and read arbitrary local files, including the WordPress configuration file. | |||||
| CVE-2025-68953 | 1 Frappe | 1 Frappe | 2026-10-14 | N/A | 7.5 HIGH |
| Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal attacks. Arbitrary files from the server could be retrieved due to a lack of proper sanitization on some requests. This issue is fixed in versions 14.99.6 and 15.88.1. To workaround, changing the setup to use a reverse proxy is recommended. | |||||
| CVE-2025-59380 | 1 Qnap | 2 Qts, Quts Hero | 2026-10-14 | N/A | 4.9 MEDIUM |
| A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following versions: QTS 5.2.8.3332 build 20251128 and later QuTS hero h5.2.8.3321 build 20251117 and later | |||||
| CVE-2025-59384 | 1 Qnap | 1 Qfiling | 2026-10-14 | N/A | 7.5 HIGH |
| A path traversal vulnerability has been reported to affect Qfiling. The remote attackers can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Qfiling 3.13.1 and later | |||||
| CVE-2026-106047 | 2026-10-14 | N/A | 7.7 HIGH | ||
| A Path Traversal vulnerability in the template export functionality of Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to read arbitrary files. | |||||
| CVE-2026-106034 | 2026-10-14 | N/A | 5.0 MEDIUM | ||
| A Path Traversal vulnerability in Ivanti Xtraction before version 2026.4 allows a remote authenticated attacker to create, modify, arbitrary directories the host file system. | |||||
| CVE-2026-90530 | 2026-10-14 | N/A | 9.3 CRITICAL | ||
| ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile. | |||||
| CVE-2026-109519 | 2026-10-14 | 7.5 HIGH | 8.3 HIGH | ||
| A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the component Template Rendering. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2026-108940 | 2026-10-14 | 6.4 MEDIUM | 6.5 MEDIUM | ||
| A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistralrs-server-core/src/handlers.rs. Performing a manipulation of the argument save_cimatrix results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 0.9.4 is sufficient to fix this issue. The patch is named 8c81056712709b4845ec6d9531e4d35bab4a367c. It is suggested to upgrade the affected component. | |||||
| CVE-2026-63312 | 1 Nltk | 1 Nltk | 2026-10-14 | N/A | 7.5 HIGH |
| NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly instead of pathsec.open(). Attackers who control the fileid argument can read arbitrary local files regardless of the ENFORCE setting, including sensitive system files and application credentials. | |||||
| CVE-2025-58173 | 1 Freshrss | 1 Freshrss | 2026-10-14 | N/A | 8.8 HIGH |
| FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it's possible to call `install.php` and perform various administrative actions as an unprivileged user. These actions include logging in as the admin, creating a new admin user, or set the database to an attacker-controlled MySQL server and abuse it to execute code in FreshRSS by setting malicious feed `curl_params` inside the `feed` table. Version 1.27.1 fixes the issue. | |||||
| CVE-2025-71427 | 2026-10-14 | N/A | 6.8 MEDIUM | ||
| Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse save_presentation, open_presentation, or manage_image output_path to overwrite any server-writable file or load external files. | |||||
| CVE-2025-1280 | 2026-10-14 | N/A | 6.5 MEDIUM | ||
| The BM Content Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to 3.17.1 (exclusive) via the ux_cb_page_customize_save_layout_ajax() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. | |||||
| CVE-2026-10053 | 1 Gitlab | 1 Gitlab | 2026-10-14 | N/A | 8.5 HIGH |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to achieve remote code execution due to a path traversal vulnerability in the package registry. | |||||