Total
543 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-47078 | 2026-10-24 | N/A | N/A | ||
| Relative Path Traversal vulnerability in Erlang OTP (stdlib zip module) allows writing files outside the intended extraction directory via a crafted zip archive. zip:unzip/1,2 and zip:extract/1,2 validate entry paths using zip:check_dir_level/2, which tracks directory depth as a running integer counter: .. decrements it, normal path components increment it. The caller rejects only paths where the final counter value is less than zero. A path such as ../x/y causes the counter to go negative mid-traversal then recover to zero, passing validation while resolving to a location outside the extraction directory when joined with the current working directory via add_cwd. This vulnerability is associated with program file lib/stdlib/src/zip.erl. This issue affects OTP from OTP 27.1 before OTP 27.3.4.15, OTP 28.5.0.4, and OTP 29.0.4, corresponding to stdlib from 6.1 before 6.2.2.4, 7.3.0.1, and 8.0.3. | |||||
| CVE-2026-55100 | 2026-10-23 | N/A | N/A | ||
| hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2. | |||||
| CVE-2026-18192 | 2026-10-23 | N/A | 6.5 MEDIUM | ||
| VIN-DS783E-E6 developed by Vacron has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files. | |||||
| CVE-2026-18907 | 2026-10-23 | N/A | 7.5 HIGH | ||
| Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write via directory traversal sequences in the filename. | |||||
| CVE-2026-10595 | 2026-10-23 | N/A | 7.5 HIGH | ||
| A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization or containment checks. URL-encoded dot-dot sequences (`%2e%2e`) bypass Starlette's built-in path normalization and are resolved by Python's `pathlib`, allowing an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3. | |||||
| CVE-2026-21082 | 1 Samsung | 1 Health | 2026-10-23 | N/A | 5.5 MEDIUM |
| Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | |||||
| CVE-2026-115812 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution. | |||||
| CVE-2026-114110 | 2026-10-22 | N/A | 5.3 MEDIUM | ||
| Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package. | |||||
| CVE-2026-106490 | 1 Linuxfoundation | 2 Backstage, Backstage\/plugin-techdocs-backend | 2026-10-22 | N/A | 6.5 MEDIUM |
| Backstage is an open framework for building developer portals. Prior to 2.2.4, the @backstage/plugin-techdocs-backend package is affected by improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure. This issue is fixed in version 2.2.4. | |||||
| CVE-2022-42476 | 1 Fortinet | 2 Fortios, Fortiproxy | 2026-10-22 | N/A | 8.2 HIGH |
| A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS 6.4.0 through 6.4.11, FortiOS 6.2.0 through 6.2.12, FortiProxy 7.2.0 through 7.2.1, FortiProxy 7.0.0 through 7.0.7, FortiProxy 2.0.0 through 2.0.11, FortiProxy 1.2 all versions, FortiProxy 01.02 all versions, FortiProxy 1.1 all versions, FortiProxy 01.01 all versions allows privileged VDOM administrators to escalate their privileges to super admin of the box via crafted CLI requests. | |||||
| CVE-2026-83873 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-21 | N/A | 7.8 HIGH |
| Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-83865 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows 10 21h2 and 11 more | 2026-10-21 | N/A | 4.7 MEDIUM |
| Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally. | |||||
| CVE-2025-15015 | 1 Ragic | 1 Enterprise Cloud Database | 2026-10-19 | N/A | 7.5 HIGH |
| Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files. | |||||
| CVE-2025-55202 | 1 Apereo | 1 Opencast | 2026-10-19 | N/A | 5.3 MEDIUM |
| Opencast is a free, open-source platform to support the management of educational audio and video content. In version 18.0 and versions before 17.7, the protections against path traversal attacks in the UI config module are insufficient, still partially allowing for attacks in very specific cases. The path is checked without checking for the file separator. This could allow attackers access to files within another folder which starts with the same path. This issue has been fixed in versions 17.7 and 18.1. To mitigate this issue, check for folders that start with the same path as the ui-config folder. | |||||
| CVE-2025-59835 | 2026-10-19 | N/A | N/A | ||
| LangBot is a global IM bot platform designed for LLMs. In versions 4.1.0 up to but not including 4.3.5, authorized attackers can exploit the /api/v1/files/documents interface to perform arbitrary file uploads. Since this interface does not strictly restrict the storage directory of files on the server, it is possible to upload dangerous files to specific system directories. This is fixed in version 4.3.5. | |||||
| CVE-2025-58760 | 1 Tautulli | 1 Tautulli | 2026-10-19 | N/A | 8.6 HIGH |
| Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. In Tautulli, the `/image` API endpoint is used to serve static images from the application's data directory to users. This endpoint can be accessed without authentication, and its intended purpose is for server background images and icons within the user interface. Attackers can exfiltrate files from the application file system, including the `tautulli.db` SQLite database containing active JWT tokens, as well as the `config.ini` file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. If the password is cracked, or if a valid JWT token is present in the database, an unauthenticated attacker can escalate their privileges to obtain administrative control over the application. Version 2.16.0 contains a fix for the issue. | |||||
| CVE-2025-10249 | 2026-10-19 | N/A | 6.5 MEDIUM | ||
| The Slider Revolution plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions in all versions up to, and including, 6.7.37. This makes it possible for authenticated attackers, with Contributor-level access and above, to install and activate plugin add-ons, create sliders, and download arbitrary files. | |||||
| CVE-2025-66386 | 2026-10-19 | N/A | 4.1 MEDIUM | ||
| app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin. | |||||
| CVE-2025-64714 | 2026-10-19 | N/A | 5.8 MEDIUM | ||
| PrivateBin is an online pastebin where the server has zero knowledge of pasted data. Starting in version 1.7.7 and prior to version 2.0.3, an unauthenticated Local File Inclusion exists in the template-switching feature. If `templateselection` is enabled in the configuration, the server trusts the `template` cookie and includes the referenced PHP file. An attacker can read sensitive data or, if they manage to drop a PHP file elsewhere, gain remote code execution. The constructed path of the template file is checked for existence, then included. For PrivateBin project files this does not leak any secrets due to data files being created with PHP code that prevents execution, but if a configuration file without that line got created or the visitor figures out the relative path to a PHP script that directly performs an action without appropriate privilege checking, those might execute or leak information. The issue has been patched in version 2.0.3. As a workaround, set `templateselection = false` (which is the default) in `cfg/conf.php` or remove it entirely | |||||
| CVE-2025-58078 | 2026-10-18 | N/A | 7.5 HIGH | ||
| A relative path traversal vulnerability was discovered in Productivity Suite software version 4.4.1.19. The vulnerability allows an unauthenticated remote attacker to interact with the ProductivityService PLC simulator and write files with arbitrary data on the target machine. | |||||