Total
10246 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-54403 | 1 Ui | 63 Enterprise Firewall Core, Enterprise Firewall Core Firmware, Enterprise Fortress Gateway and 60 more | 2026-07-10 | N/A | 8.6 HIGH |
| A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices running UniFi OS to bypass authentication of such UniFi OS devices or instances. | |||||
| CVE-2026-59221 | 1 Openwebui | 1 Open Webui | 2026-07-10 | N/A | 7.7 HIGH |
| Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 before 0.10.0, _sanitize_proxy_path in backend/open_webui/routers/terminals.py decoded proxy paths only eight times, allowing a nine-times percent-encoded ../ traversal value to pass normalization checks and be decoded by the upstream terminal server. This issue is fixed in version 0.10.0. | |||||
| CVE-2026-59924 | 1 Mistune Project | 1 Mistune | 2026-07-09 | N/A | 5.9 MEDIUM |
| Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, Include.parse() joins and normalizes user-supplied include paths without verifying that the result remains within the intended markdown directory, allowing crafted include paths to access files outside that directory when markdown files are processed using md.read(). This issue is fixed in version 3.3.0. | |||||
| CVE-2026-15138 | 2026-07-09 | 7.5 HIGH | 6.3 MEDIUM | ||
| A security vulnerability has been detected in tumf mcp-text-editor up to 1.0.2. This issue affects the function _validate_file_path of the file mcp_text_editor/text_editor.py. Such manipulation of the argument file_path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor closed the GitHub issue for this vulnerability without any explanation. | |||||
| CVE-2026-14372 | 2026-07-09 | N/A | 7.1 HIGH | ||
| The Bit Form – Contact Form, Payment Forms, Multi Step Forms, Calculator & Custom Form Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function in all versions up to, and including, 3.1.1 This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config). | |||||
| CVE-2026-56273 | 2026-07-09 | N/A | 6.5 MEDIUM | ||
| Flowise before 3.1.0 contains a path traversal vulnerability in Faiss and SimpleStore vector store implementations that accept unsanitized basePath parameters from authenticated users. Attackers with valid API tokens can write vector store data to arbitrary filesystem locations, potentially enabling code execution or data exfiltration. | |||||
| CVE-2023-38950 | 1 Zkteco | 1 Biotime | 2026-07-09 | N/A | 7.5 HIGH |
| A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. This vulnerability was fixed in version 9.0.120240617.19506 of ZKBioTime. | |||||
| CVE-2026-55111 | 1 Ui | 2 Protect Floodlight, Protect Floodlight Firmware | 2026-07-09 | N/A | 7.5 HIGH |
| A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodlight devices to access files on the UniFi Protect Floodlight. | |||||
| CVE-2024-39171 | 1 Phpvibe | 1 Phpvibe | 2026-07-09 | N/A | 9.8 CRITICAL |
| Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statements to .htaccess and code to a file with a .png suffix. | |||||
| CVE-2024-24398 | 1 Stimulsoft | 1 Dashboards.php | 2026-07-09 | N/A | 9.8 CRITICAL |
| Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary code via a crafted payload to the fileName parameter of the Save function. | |||||
| CVE-2023-47890 | 1 Pyload | 1 Pyload | 2026-07-09 | N/A | 8.8 HIGH |
| pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. | |||||
| CVE-2023-39810 | 1 Busybox | 1 Busybox | 2026-07-09 | N/A | 7.8 HIGH |
| An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal. | |||||
| CVE-2023-38956 | 1 Zkteco | 1 Bioaccess Ivs | 2026-07-09 | N/A | 7.5 HIGH |
| A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a crafted payload. | |||||
| CVE-2023-38951 | 1 Zkteco | 1 Biotime | 2026-07-09 | N/A | 9.8 CRITICAL |
| ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server via crafted requests to /base/sftpsetting/ endpoints that abuse a path traversal issue in the Username field and a lack of input sanitization on the SSH Key field. Overwriting specific files may lead to arbitrary code execution as NT AUTHORITY\SYSTEM. | |||||
| CVE-2023-37646 | 1 Bitberry | 1 File Opener | 2026-07-09 | N/A | 7.8 HIGH |
| An issue in the CAB file extraction function of Bitberry File Opener v23.0 allows attackers to execute a directory traversal. | |||||
| CVE-2023-37607 | 1 Automaticsystems | 2 Soc Fl9600 Firstlane, Soc Fl9600 Firstlane Firmware | 2026-07-09 | N/A | 7.5 HIGH |
| Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via csvServer.php?file= with a .. in the dir parameter. | |||||
| CVE-2023-33411 | 1 Supermicro | 724 B12dpe-6, B12dpe-6 Firmware, B12dpt-6 and 721 more | 2026-07-09 | N/A | 7.5 HIGH |
| A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information. | |||||
| CVE-2023-27812 | 1 Bloofox | 1 Bloofoxcms | 2026-07-09 | N/A | 9.1 CRITICAL |
| bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function. | |||||
| CVE-2023-24188 | 1 Ureport Project | 1 Ureport | 2026-07-09 | N/A | 9.1 CRITICAL |
| ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to be deleted. | |||||
| CVE-2022-47768 | 1 Serinf | 1 Fast Checkin | 2026-07-09 | N/A | 7.5 HIGH |
| Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal. | |||||