Total
748 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-8517 | 1 Spip | 1 Spip | 2026-10-29 | N/A | 9.8 CRITICAL |
| SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute arbitrary operating system commands by sending a crafted multipart file upload HTTP request. | |||||
| CVE-2026-93864 | 2026-10-29 | N/A | N/A | ||
| A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and triggering a list update. Written content is partially constrained. | |||||
| CVE-2026-92709 | 2026-10-29 | N/A | 8.1 HIGH | ||
| Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfile dynaFile facility intentionally allows templates to generate flexible output paths. This supports valid deployments that route logs into different directories or use dynamically generated file names. A deployment becomes unsafe when a dynaFile template uses a value influenced by untrusted input as a path component without explicit secure-path handling. In that configuration, the rendered path can escape the operator's intended log directory. This is not limited to the RFC5424 HOSTNAME field. Any untrusted value that reaches a dynaFile path component can create the condition. At time of publication, there are no publicly available patches. | |||||
| CVE-2026-66324 | 1 Microsoft | 1 Edge Chromium | 2026-10-28 | N/A | 6.5 MEDIUM |
| External control of file name or path in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. | |||||
| CVE-2026-114491 | 2026-10-28 | N/A | 5.3 MEDIUM | ||
| pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents in the generated PDF. | |||||
| CVE-2026-114253 | 2026-10-28 | 7.5 HIGH | 6.3 MEDIUM | ||
| A vulnerability was determined in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. The impacted element is the function include of the file index.php. Executing a manipulation of the argument page can lead to file inclusion. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet. | |||||
| CVE-2026-90464 | 2026-10-28 | N/A | N/A | ||
| An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only (Device Monitor) privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel parameters with root privileges by submitting a specially crafted command. Written content is limited to numeric values. | |||||
| CVE-2026-114379 | 2026-10-28 | 5.5 MEDIUM | 5.4 MEDIUM | ||
| A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packages/server/src/modules/studio/controllers/media.ts of the component Media Generation API. This manipulation of the argument output_path causes file inclusion. Remote exploitation of the attack is possible. Patch name: 1d42459c292f89e412f7f6243829e7fed2e85bf5. It is recommended to apply a patch to fix this issue. | |||||
| CVE-2026-5821 | 2026-10-28 | N/A | 8.1 HIGH | ||
| The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_optimizer_metadata post meta field and trusts these paths completely when deleting backups on the delete_attachment hook. An authenticated attacker with Author-level access can edit the image_optimizer_metadata post meta on their own attachments via WordPress's Custom Fields interface, injecting arbitrary absolute file paths into the backups array. When the attacker subsequently deletes the attachment, the plugin calls File_System::delete() on each path without validation. This makes it possible for authenticated attackers, with Author-level access and above, to delete arbitrary files on the server within the web server's filesystem permissions, potentially leading to denial of service, data loss, or security degradation. | |||||
| CVE-2026-116822 | 2026-10-27 | N/A | 5.3 MEDIUM | ||
| YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary templates within the @bazar Twig namespace via the template GET parameter. Attackers can append crafted template values to pages containing the bazarliste action to force unintended layouts, causing page defacement for visitors following the crafted link. | |||||
| CVE-2026-40086 | 1 Danielgatis | 1 Rembg | 2026-10-26 | N/A | 5.3 MEDIUM |
| Rembg is a tool to remove images background. Prior to 2.0.75, a path traversal vulnerability in the rembg HTTP server allows unauthenticated remote attackers to read arbitrary files from the server's filesystem. By sending a crafted request with a malicious model_path parameter, an attacker can force the server to attempt loading any file as an ONNX model, revealing file existence, permissions, and potentially file contents through error messages. This vulnerability is fixed in 2.0.75. | |||||
| CVE-2026-40342 | 1 Firebirdsql | 1 Firebird | 2026-10-26 | N/A | 9.9 CRITICAL |
| Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14, the external engine plugin loader concatenates a user-supplied engine name into a filesystem path without filtering path separators or .. components. An authenticated user with CREATE FUNCTION privileges can use a crafted ENGINE name to load an arbitrary shared library from anywhere on the filesystem via path traversal. The library's initialization code executes immediately during loading, before Firebird validates the module, achieving code execution as the server's OS account. This issue has been fixed in versions 5.0.4, 4.0.7 and 3.0.14. | |||||
| CVE-2026-39377 | 1 Jupyter | 1 Nbconvert | 2026-10-26 | N/A | 6.5 MEDIUM |
| The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions 6.5 through 7.17.0 allow arbitrary file writes to locations outside the intended output directory when processing notebooks containing crafted cell attachment filenames. The `ExtractAttachmentsPreprocessor` passes attachment filenames directly to the filesystem without sanitization, enabling path traversal attacks. This vulnerability provides complete control over both the destination path and file extension. Version 7.17.1 contains a patch. | |||||
| CVE-2026-35465 | 1 Freedom | 1 Securedrop-client | 2026-10-26 | N/A | 7.5 HIGH |
| SecureDrop Client is a desktop app for journalists to securely communicate with sources and handle submissions on the SecureDrop Workstation. In versions 0.17.4 and below, a compromised SecureDrop Server can achieve code execution on the Client's virtual machine (sd-app) by exploiting improper filename validation in gzip archive extraction, which permits absolute paths and enables overwriting critical files like the SQLite database. Exploitation requires prior compromise of the dedicated SecureDrop Server, which itself is hardened and only accessible via Tor hidden services. Despite the high attack complexity, the vulnerability is rated High severity due to its significant impact on confidentiality, integrity, and availability of decrypted source submissions. This issue is similar to CVE-2025-24888 but occurs through a different code path, and a more robust fix has been implemented in the replacement SecureDrop Inbox codebase. The issue has been fixed in version 0.17.5. | |||||
| CVE-2026-31939 | 1 Chamilo | 1 Chamilo Lms | 2026-10-26 | N/A | 8.3 HIGH |
| Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $_REQUEST['test'] is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerability is fixed in 1.11.38. | |||||
| CVE-2026-33989 | 1 Mobilenexthq | 1 Mobile Mcp | 2026-10-26 | N/A | 8.1 HIGH |
| Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@mobilenext/mobile-mcp` server contains a Path Traversal vulnerability in the `mobile_save_screenshot` and `mobile_start_screen_recording` tools. The `saveTo` and `output` parameters were passed directly to filesystem operations without validation, allowing an attacker to write files outside the intended workspace. Version 0.0.49 fixes the issue. | |||||
| CVE-2026-39378 | 1 Jupyter | 1 Nbconvert | 2026-10-26 | N/A | 6.5 MEDIUM |
| The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. In versions 6.5 through 7.17.0, when `HTMLExporter.embed_images=True`, nbconvert's markdown renderer allows arbitrary file read via path traversal in image references. A malicious notebook can exfiltrate sensitive files from the conversion host by embedding them as base64 data URIs in the output HTML. nbconvert 7.17.1 contains a fix. As a workaround, do not enable `HTMLExporter.embed_images`; it is not enabled by default. | |||||
| CVE-2026-23898 | 1 Joomla | 1 Joomla\! | 2026-10-26 | N/A | 7.2 HIGH |
| Lack of input validation leads to an arbitrary file deletion vulnerability in the autoupdate server mechanism. | |||||
| CVE-2026-69783 | 1 Microsoft | 6 Windows 11 23h2, Windows 11 24h2, Windows 11 25h2 and 3 more | 2026-10-26 | N/A | 7.8 HIGH |
| External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-7633 | 2026-10-26 | 6.4 MEDIUM | 6.5 MEDIUM | ||
| A vulnerability was identified in Totolink N300RH 6.1c.1353_B20190305. This impacts the function setUploadSetting of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument FileName leads to file inclusion. The attack may be performed from remote. The exploit is publicly available and might be used. | |||||