Total
193 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-39734 | 2026-10-30 | N/A | 7.5 HIGH | ||
| Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions. | |||||
| CVE-2026-118633 | 2026-10-29 | N/A | 8.1 HIGH | ||
| A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning enabled. Sophos UTM is end-of-life and the patch must be installed manually. | |||||
| CVE-2026-28265 | 1 Dell | 13 Powerstore 1000t, Powerstore 1200t, Powerstore 3000t and 10 more | 2026-10-26 | N/A | 4.4 MEDIUM |
| PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files. | |||||
| CVE-2026-6074 | 2026-10-26 | N/A | 9.8 CRITICAL | ||
| Intrado 911 Emergency Gateway (EGW) 5.x, 6.x, and 7.x contain a path traversal vulnerability in the download_debuglog_file.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory. | |||||
| CVE-2026-42274 | 2026-10-26 | N/A | N/A | ||
| Heimdall is a cloud native Identity Aware Proxy and Access Control Decision service. Prior to version 0.17.14, Heimdall performs rule matching on the raw (non-normalized) request path, while downstream components may normalize dot-segments according to RFC 3986, Section 6.2.2.3. This discrepancy can result in heimdall authorizing a request for one path (e.g., /user/../admin, or URL-encoded variants such as /user/%2e%2e/admin or /user/%2e%2e%2fadmin. The latter would require the allow_encoded_slashes option to be set to on or no_decode.) while the downstream ultimately processes a different, normalized path (/admin). This issue has been patched in version 0.17.14. | |||||
| CVE-2026-0205 | 1 Sonicwall | 64 Nsa 2650, Nsa 2700, Nsa 2800 and 61 more | 2026-10-26 | N/A | 6.8 MEDIUM |
| A post-authentication Path Traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. | |||||
| CVE-2026-20034 | 1 Cisco | 1 Unity Connection | 2026-10-26 | N/A | 8.8 HIGH |
| A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by submitting a crafted API request. A successful exploit could allow the attacker to execute arbitrary code as root, possibly resulting in the complete compromise of a targeted device. To exploit this vulnerability, the attacker must have valid user credentials on the affected device. | |||||
| CVE-2026-0804 | 1 Axis | 1 Axis Os | 2026-10-26 | N/A | 6.7 MEDIUM |
| An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. | |||||
| CVE-2026-25705 | 2026-10-26 | N/A | 8.4 HIGH | ||
| A vulnerability has been identified in [Rancher's Extensions](https://ranchermanager.docs.rancher.com/integrations-in-rancher/rancher-extensions) where malicious code can be injected in Rancher through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could abuse that to: * Overwrite Rancher binaries or configuration to inject code. * Write to /var/lib/rancher/ to tamper with cluster state. * If hostPath volumes are mounted, write to the host node filesystem. * Use this issue to chain with other attack vectors. | |||||
| CVE-2026-24464 | 1 F5 | 21 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Advanced Web Application Firewall and 18 more | 2026-10-26 | N/A | 6.8 MEDIUM |
| When running in Appliance mode, a directory traversal vulnerability exists in an undisclosed iControl REST endpoint that may allow an authenticated attacker with administrator role privileges to cross a security boundary and delete files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-42930 | 1 F5 | 21 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Advanced Web Application Firewall and 18 more | 2026-10-26 | N/A | 8.7 HIGH |
| When running in Appliance mode, an authenticated attacker assigned the 'Administrator' role may be able to bypass Appliance mode restrictions on a BIG-IP system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. | |||||
| CVE-2026-52707 | 2026-10-26 | N/A | 8.1 HIGH | ||
| Unauthenticated Local File Inclusion in Kastell <= 2.0 versions. | |||||
| CVE-2026-49112 | 2026-10-25 | N/A | 7.5 HIGH | ||
| Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions. | |||||
| CVE-2026-42661 | 2026-10-25 | N/A | 8.8 HIGH | ||
| Custom role Path Traversal in WP Customer Area <= 8.3.4 versions. | |||||
| CVE-2026-52703 | 2026-10-25 | N/A | 9.6 CRITICAL | ||
| Unauthenticated Path Traversal in FastDup <= 2.7.2 versions. | |||||
| CVE-2026-49779 | 2026-10-25 | N/A | 6.5 MEDIUM | ||
| Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a before 1.9.5. | |||||
| CVE-2026-66695 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions. | |||||
| CVE-2026-59115 | 1 Microsoft | 1 Entra Provisioning Service | 2026-10-24 | N/A | 9.9 CRITICAL |
| '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69109 | 2026-10-23 | N/A | 7.5 HIGH | ||
| A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application. | |||||
| CVE-2025-48090 | 2026-10-23 | N/A | 8.1 HIGH | ||
| Path Traversal: '.../...//' vulnerability in CocoBasic Blanka - One Page WordPress Theme blanka-wp allows PHP Local File Inclusion.This issue affects Blanka - One Page WordPress Theme: from n/a through < 1.5. | |||||