Total
193 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-13716 | 1 Craftycontrol | 1 Crafty Controller | 2026-10-23 | N/A | 9.1 CRITICAL |
| Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution. | |||||
| CVE-2026-28157 | 2026-10-23 | N/A | 7.5 HIGH | ||
| Subscriber Path Traversal in Do Lasso <= 358 versions. | |||||
| CVE-2025-4956 | 2026-10-18 | N/A | 4.3 MEDIUM | ||
| Path Traversal: '.../...//' vulnerability in AA-Team Pro Bulk Watermark Plugin for WordPress allows Path Traversal.This issue affects Pro Bulk Watermark Plugin for WordPress: from n/a through 2.0. | |||||
| CVE-2025-39467 | 1 Qodeinteractive | 1 Wanderland | 2026-10-18 | N/A | 8.1 HIGH |
| Path Traversal: '.../...//' vulnerability in Mikado-Themes Wanderland wanderland allows PHP Local File Inclusion.This issue affects Wanderland: from n/a through <= 1.7.1. | |||||
| CVE-2025-41723 | 2026-10-18 | N/A | 9.8 CRITICAL | ||
| The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations. | |||||
| CVE-2025-41736 | 1 Metz-connect | 6 Ewio2-bm, Ewio2-bm Firmware, Ewio2-m and 3 more | 2026-10-18 | N/A | 8.8 HIGH |
| A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in php resulting in a remote code execution. | |||||
| CVE-2025-53880 | 2026-10-18 | N/A | N/A | ||
| A Path Traversal vulnerability in the tftpsync/add and tftpsync/delete scripts allows a remote attacker on an adjacent network to write or delete files on the filesystem with the privileges of the unprivileged wwwrun user. Although the endpoint is unauthenticated, access is restricted to a list of allowed IP addresses. | |||||
| CVE-2026-44414 | 2026-10-15 | N/A | 6.8 MEDIUM | ||
| A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial Edge Device Kit - arm64 V1.15, Industrial Edge Device Kit - arm64 V1.16, Industrial Edge Device Kit - arm64 V1.17, Industrial Edge Device Kit - arm64 V1.18, Industrial Edge Device Kit - arm64 V1.19, Industrial Edge Device Kit - arm64 V1.20, Industrial Edge Device Kit - arm64 V1.21, Industrial Edge Device Kit - arm64 V1.22, Industrial Edge Device Kit - arm64 V1.23, Industrial Edge Device Kit - arm64 V1.24, Industrial Edge Device Kit - arm64 V1.25, Industrial Edge Device Kit - arm64 V1.26, Industrial Edge Device Kit - arm64 V1.27, Industrial Edge Device Kit - arm64 V1.28, Industrial Edge Device Kit - arm64 V1.5, Industrial Edge Device Kit - arm64 V1.6, Industrial Edge Device Kit - arm64 V1.7, Industrial Edge Device Kit - arm64 V1.8, Industrial Edge Device Kit - arm64 V1.9, Industrial Edge Device Kit - x86-64 V1.10, Industrial Edge Device Kit - x86-64 V1.11, Industrial Edge Device Kit - x86-64 V1.12, Industrial Edge Device Kit - x86-64 V1.13, Industrial Edge Device Kit - x86-64 V1.14, Industrial Edge Device Kit - x86-64 V1.15, Industrial Edge Device Kit - x86-64 V1.16, Industrial Edge Device Kit - x86-64 V1.17, Industrial Edge Device Kit - x86-64 V1.18, Industrial Edge Device Kit - x86-64 V1.19, Industrial Edge Device Kit - x86-64 V1.20, Industrial Edge Device Kit - x86-64 V1.21, Industrial Edge Device Kit - x86-64 V1.22, Industrial Edge Device Kit - x86-64 V1.23, Industrial Edge Device Kit - x86-64 V1.24, Industrial Edge Device Kit - x86-64 V1.25, Industrial Edge Device Kit - x86-64 V1.26, Industrial Edge Device Kit - x86-64 V1.27, Industrial Edge Device Kit - x86-64 V1.28, Industrial Edge Device Kit - x86-64 V1.5, Industrial Edge Device Kit - x86-64 V1.6, Industrial Edge Device Kit - x86-64 V1.7, Industrial Edge Device Kit - x86-64 V1.8, Industrial Edge Device Kit - x86-64 V1.9, Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413 (6GK5998-3GS01-2AC2), SCALANCE LPE9433 (6GK5998-3GS11-2AC2), SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2), SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2), SIMATIC IPC BX-21A Industrial Edge Device, SIMATIC IPC BX-39A Industrial Edge Device, SIMATIC IPC BX-59A Industrial Edge Device, SIMATIC IPC127E Industrial Edge Device, SIMATIC IPC227E Industrial Edge Device, SIMATIC IPC227G Industrial Edge Device, SIMATIC IPC427E Industrial Edge Device, SIMATIC IPC847E Industrial Edge Device. Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system. | |||||
| CVE-2026-44415 | 2026-10-15 | N/A | 9.1 CRITICAL | ||
| Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data. | |||||
| CVE-2025-66004 | 2026-10-14 | N/A | 5.7 MEDIUM | ||
| A Path Traversal vulnerability in usbmuxd allows local users to escalate to the service user.This issue affects usbmuxd: before 3ded00c9985a5108cfc7591a309f9a23d57a8cba. | |||||
| CVE-2026-45495 | 1 Microsoft | 1 Edge Chromium | 2026-10-14 | N/A | 8.8 HIGH |
| Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | |||||
| CVE-2026-7302 | 1 Lmsys | 1 Sglang | 2026-10-14 | N/A | 9.1 CRITICAL |
| SGLangs multimodal generation runtime is vulnerable to an unauthenticated path traversal vulnerability, allowing an attacker to write arbitrary files anywhere the server process has write access, by including ../ sequences in the upload filename when sent to specific endpoints. | |||||
| CVE-2025-60835 | 2026-10-12 | N/A | 7.8 HIGH | ||
| An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal. | |||||
| CVE-2025-8051 | 1 Opentext | 1 Flipper | 2026-10-08 | N/A | 6.5 MEDIUM |
| Path Traversal vulnerability in opentext Flipper allows Absolute Path Traversal. The vulnerability could allow a user to access files hosted on the server. This issue affects Flipper: 3.1.2. | |||||
| CVE-2025-42937 | 2026-10-08 | N/A | 9.8 CRITICAL | ||
| SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availability of the application. | |||||
| CVE-2026-105683 | 2026-10-08 | N/A | 3.8 LOW | ||
| Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0. | |||||
| CVE-2025-5454 | 1 Axis | 233 A1210 \(-b\), A1214, A1601 and 230 more | 2026-10-07 | N/A | 6.4 MEDIUM |
| An ACAP configuration file lacked sufficient input validation, which could allow a path traversal attack leading to potential privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. | |||||
| CVE-2025-58972 | 2026-10-07 | N/A | 7.2 HIGH | ||
| Path Traversal: '.../...//' vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders allows Path Traversal.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.10.4. | |||||
| CVE-2025-22288 | 2026-10-07 | N/A | 4.1 MEDIUM | ||
| Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through <= 3.17.0. | |||||
| CVE-2026-5703 | 2026-10-07 | N/A | N/A | ||
| Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information. | |||||