Total
507 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-18192 | 2026-07-30 | N/A | 6.5 MEDIUM | ||
| VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files. | |||||
| CVE-2026-50454 | 1 Microsoft | 4 Windows 11 24h2, Windows 11 25h2, Windows 11 26h1 and 1 more | 2026-07-29 | N/A | 7.8 HIGH |
| Relative path traversal in Windows User Interface Core allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-50426 | 1 Microsoft | 7 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 4 more | 2026-07-29 | N/A | 6.8 MEDIUM |
| Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network. | |||||
| CVE-2026-32725 | 1 Scitokens | 1 Scitokens Cpp Library | 2026-07-24 | N/A | 8.3 HIGH |
| SciTokens C++ is a minimal library for creating and using SciTokens from C or C++. Prior to version 1.4.1, scitokens-cpp is vulnerable to an authorization bypass when processing path-based scopes in tokens. The library normalizes the scope path from the token before authorization and collapses ".." path components instead of rejecting them. As a result, an attacker can use parent-directory traversal in the scope claim to broaden the effective authorization beyond the intended directory. This issue has been patched in version 1.4.1. | |||||
| CVE-2026-50663 | 1 Microsoft | 1 Age Of Empires Ii | 2026-07-24 | N/A | 8.8 HIGH |
| Relative path traversal in Age of Empires II: Definitive Edition Game allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-21620 | 2026-07-24 | N/A | N/A | ||
| Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl. This issue affects OTP from OTP 17.0 before OTP 28.3.2, OTP 27.3.4.8 and OTP 26.2.5.17, corresponding to tftp from 1.0 before 1.2.4, 1.2.2.1 and 1.1.1.1; also inets from 5.10 before 7.0. | |||||
| CVE-2026-56196 | 1 Microsoft | 1 Windows Admin Center | 2026-07-24 | N/A | 8.8 HIGH |
| Relative path traversal in Windows Admin Center allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-48126 | 2026-07-24 | N/A | 8.2 HIGH | ||
| Algernon is a small self-contained pure-Go web server. Prior to 1.17.8, when algernon is started with --domain (or --letsencrypt, which silently turns on --domain at engine/flags.go:372), the request handler resolves the served directory by joining the configured --dir with the value of the client-supplied Host header. The join is performed by filepath.Join with no validation, so a Host: .. header walks one level above the document root. Subsequent file resolution then exposes everything in that parent directory — arbitrary file read, full directory listing, and, if any .lua file is present, server-side Lua execution. This vulnerability is fixed in 1.17.8. | |||||
| CVE-2026-8073 | 2026-07-24 | N/A | 7.5 HIGH | ||
| The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function in all versions up to, and including, 6.0.6. This makes it possible for unauthenticated attackers to read and delete arbitrary files limited in the WordPress uploads base directory. | |||||
| CVE-2026-8209 | 2026-07-24 | N/A | N/A | ||
| Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application. | |||||
| CVE-2026-54910 | 2026-07-23 | N/A | 7.7 HIGH | ||
| FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.4.3-beta, the `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors. The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required. The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`. Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys. Version 1.4.3-beta patches the issue. | |||||
| CVE-2026-8134 | 1 Concretecms | 1 Concrete Cms | 2026-07-23 | N/A | 7.2 HIGH |
| Concrete CMS 9.5.0 and below fails to sanitize path traversal sequences in the ptComposerFormLayoutSetControlCustomTemplate field when saving page type composer form layouts. An authenticated rogue administrator with composer form editing rights can exploit this to include arbitrary readable files on the server. Combined with the file uploader's extension-only validation (which permits PHP code in files saved with image extensions like .png), this can result in authenticated remote code execution. The Concrete CMS security team gave this vulnerability a CVSS v.4.0 score of 9.4 with vector CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H Thanks Yonatan Drori (Tenzai) for reporting. | |||||
| CVE-2026-34926 | 1 Trendmicro | 1 Apex One | 2026-07-23 | N/A | 6.7 MEDIUM |
| A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the server to inject malicious code to deploy to agents on affected installations. This vulnerability is only exploitable on the on-premise version of Apex One and a potential attacker must have access to the Apex One Server and already obtained administrative credentials to the server via some other method to exploit this vulnerability. | |||||
| CVE-2026-23734 | 2026-07-23 | N/A | N/A | ||
| XWiki Platform is a generic wiki platform. Versions prior to 18.1.0-rc-1, 17.10.3, 17.4.9, and 16.10.17 allow access to read configuration files by using URLs such as http://localhost:8080/bin/ssx/Main/WebHome?resource=/../../WEB-INF/xwiki.cfg&minify=false, leading to Path Traversal. The vulnerability is can be exploited via resources parameter the ssx and jsx endpoints by using leading slashes. This issue has been patched in 18.1.0-rc-1, 17.10.3, 17.4.9, 16.10.17. | |||||
| CVE-2026-47287 | 1 Microsoft | 1 Visual Studio Code | 2026-07-23 | N/A | 6.5 MEDIUM |
| Relative path traversal in Visual Studio Code allows an unauthorized attacker to perform tampering over a network. | |||||
| CVE-2026-48569 | 1 Microsoft | 1 Visual Studio Code | 2026-07-23 | N/A | 7.1 HIGH |
| Improper input validation in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | |||||
| CVE-2026-48681 | 1 Openstack | 1 Ironic | 2026-07-22 | N/A | 5.9 MEDIUM |
| OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. | |||||
| CVE-2026-5422 | 1 Jupyter | 1 Jupyter Server | 2026-07-22 | N/A | 8.1 HIGH |
| A path traversal vulnerability exists in jupyter-server version 2.17.0 due to an incorrect root directory boundary check in the _get_os_path() function within jupyter_server/services/contents/fileio.py. The check uses startswith(root) without appending a trailing path separator, allowing sibling directories with names starting with the same prefix as root_dir to bypass the check. Additionally, the to_os_path() function in utils.py does not strip ".." from path parts, enabling traversal sequences to bypass the vulnerable check. This vulnerability can lead to unauthorized read/write access to files in sibling directories, potentially exposing sensitive data in shared hosting environments. | |||||
| CVE-2026-15802 | 2026-07-22 | N/A | 8.1 HIGH | ||
| The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions up to, and including, 4.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). | |||||
| CVE-2026-40400 | 1 Microsoft | 12 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 9 more | 2026-07-22 | N/A | 8.0 HIGH |
| Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network. | |||||