Total
646 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-79692 | 1 Dell | 1 Secure Connect Gateway | 2026-09-09 | N/A | 7.3 HIGH |
| Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control of File Name or Path vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to filesystem access for attacker. | |||||
| CVE-2026-53580 | 2026-09-09 | N/A | 8.1 HIGH | ||
| Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files readable by the Trilium process. When a text note is saved, Trilium scans its HTML for image sources and downloads each external one; because the HTML sanitizer keeps file as an allowed scheme, a source such as file:///etc/passwd is passed straight to a filesystem read and its contents are stored as a note attachment the user can then retrieve. Pointing the same primitive at an unbounded source such as /dev/zero causes uncontrolled memory allocation that crashes the server process. The feature is enabled by default and is reachable through the web UI, the ETAPI, the web clipper, and note imports, requiring only an authenticated session or an ETAPI token. This issue is fixed in version 0.104.0 | |||||
| CVE-2026-79426 | 2026-09-09 | N/A | 7.2 HIGH | ||
| An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to delete arbitrary files via crafted POST request. | |||||
| CVE-2026-53581 | 2026-09-09 | N/A | 9.0 CRITICAL | ||
| OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and force the system to write user-controlled data to any file on the filesystem. Version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core patch the issue. | |||||
| CVE-2026-69805 | 2026-09-09 | N/A | 7.5 HIGH | ||
| External control of file name or path in .NET allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-69383 | 2026-09-09 | N/A | 7.0 HIGH | ||
| External control of file name or path in Windows Shell allows an authorized attacker to elevate privileges locally. | |||||
| CVE-2026-69355 | 2026-09-09 | N/A | 8.8 HIGH | ||
| External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network. | |||||
| CVE-2026-66302 | 2026-09-09 | N/A | 9.8 CRITICAL | ||
| External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network. | |||||
| CVE-2026-75830 | 2026-09-08 | N/A | 7.1 HIGH | ||
| grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method. An incomplete fix for GHSA-qjq4-jp55-4mx2 left the user-controlled 'suffix' parameter (via POST /api/v1/pages/batch) unvalidated. An authenticated user with the api.pages.write permission (editor-level, not super-admin) can supply path traversal sequences (e.g. /../../../) in the suffix parameter to escape the intended user/pages/ directory and write attacker-controlled page content and page media to arbitrary filesystem locations writable by the web server process. The vulnerability is fixed in 1.0.15. | |||||
| CVE-2026-75913 | 2026-09-08 | N/A | 9.3 CRITICAL | ||
| CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an attacker (via a malicious repository combined with prompt injection) can cause an unprompted arbitrary file write at the privilege of the invoking user, targeting sensitive files such as ~/.ssh/authorized_keys, ~/.bashrc, or ~/.gitconfig. Fixed in 0.8.64 by adding rev validation. | |||||
| CVE-2026-34967 | 2026-09-08 | N/A | 5.4 MEDIUM | ||
| Adminer versions 5.3.0 through 5.4.2 with the sql-log plugin enabled contain an arbitrary file write vulnerability in the ns parameter of plugins/sql-log.php. An authenticated user can supply path traversal sequences in the ns parameter to write arbitrary .sql files with attacker-controlled content to any writable directory on the host. | |||||
| CVE-2026-56705 | 2026-09-08 | N/A | 9.8 CRITICAL | ||
| Adminer before 5.4.3 fails to sanitize the server field before constructing a PDO DSN string, allowing unauthenticated attackers to inject ODBC parameters via semicolons. Attackers can inject TraceFile and TraceOn parameters to write PHP code to the web root, achieving remote code execution when the trace file is accessed. | |||||
| CVE-2026-85160 | 2026-09-08 | N/A | 8.1 HIGH | ||
| AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers to delete directories by exploiting missing token validation and unsanitized key parameter concatenation. Attackers can craft an image tag with a traversal payload like key=../../videos to trigger recursive deletion of the videos directory when an admin visits a malicious page. | |||||
| CVE-2026-84478 | 2026-09-08 | N/A | 7.3 HIGH | ||
| WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete arbitrary .log files by supplying directory traversal sequences in the code parameter. Attackers can exploit this to destroy audit logs and probe for file existence on the server, with the vulnerability enabling both file deletion and information disclosure about the filesystem. | |||||
| CVE-2026-62804 | 1 Microsoft | 6 365 Apps, Microsoft 365, Office 2016 and 3 more | 2026-09-08 | N/A | 7.8 HIGH |
| External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. | |||||
| CVE-2026-80119 | 2026-09-08 | N/A | 7.8 HIGH | ||
| PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an information disclosure vulnerability in DirectIo64.sys that allows unauthenticated local attackers to dump complete physical memory contents by supplying a caller-controlled file path to an exposed IOCTL. Attackers can issue a single IOCTL call to trigger the driver to iterate all physical memory ranges via MmGetPhysicalMemoryRanges and map each page through ZwMapViewOfSection on the PhysicalMemory section object, writing a full RAM image to an attacker-specified path in the SYSTEM context, bypassing user-mode ACLs and exposing LSASS working set, process memory, and cryptographic material from all running processes. | |||||
| CVE-2026-86189 | 2026-09-08 | N/A | 9.8 CRITICAL | ||
| WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previously issued ciphertext as a notifyCode token, which is decrypted but never validated, to bypass authentication and write files to the application root and subdirectories. | |||||
| CVE-2026-81347 | 2026-09-08 | N/A | 5.9 MEDIUM | ||
| The Frontend Admin by DynamiApps WordPress plugin before 3.29.13 does not properly validate a user-controllable directory path before deleting files within it, allowing unauthenticated attackers to delete index.php and .htaccess files outside the intended directory, including the WordPress root, which can render the site inoperable. Successful exploitation requires a non-default form configuration. | |||||
| CVE-2026-82194 | 2026-09-08 | N/A | 5.5 MEDIUM | ||
| The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied path before using it in a file deletion routine, allowing administrators to delete arbitrary files on the server, including files outside the web root. | |||||
| CVE-2026-81830 | 2026-09-08 | N/A | N/A | ||
| The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directory constraint via incorrect file path validation | |||||