Total
503 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-63043 | 1 Apache | 1 Inlong | 2026-08-27 | 7.5 High |
| Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://github.com/apache/inlong/pull/12146 . | ||||
| CVE-2026-53528 | 1 Perber | 1 Leafwiki | 2026-08-26 | 8.8 High |
| LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local files, such as the application database, to become downloadable as page assets. Users should update to version 0.10.1 or greater. As an additional mitigation, operators should ensure that the LeafWiki process runs with the least privileges necessary and does not have filesystem access to sensitive files outside the application’s required directories. Until a patch is applied, operators may reduce risk by restricting editor access to trusted users only and by limiting the filesystem permissions of the LeafWiki process. | ||||
| CVE-2026-63490 | 1 Jknack | 1 Handlebars.java | 2026-08-25 | 7.5 High |
| Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.3, com.github.jknack.handlebars.springmvc.SpringTemplateLoader resolves attacker-influenced Spring MVC view names through Spring ResourceLoader without the path-containment validation used by other URL-based loaders. In handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/SpringTemplateLoader.java, a view name using a file: or classpath: URL and ending with the # fragment delimiter places the appended .hbs suffix in the fragment, which FileUrlResource.exists() and URL.openStream() discard. HandlebarsViewResolver in handlebars-springmvc/src/main/java/com/github/jknack/handlebars/springmvc/HandlebarsViewResolver.java then passes the attacker-controlled name to handlebars.compile(), allowing an unauthenticated remote attacker to read files accessible to the JVM when an application exposes a controller with a user-influenced view name. This issue is fixed in version 4.5.3. | ||||
| CVE-2026-78212 | 1 4mosan Security Technology | 1 4mosan Management Center | 2026-08-24 | 7.5 High |
| 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files. | ||||
| CVE-2026-66897 | 1 Canonical | 1 Lxd | 2026-08-24 | 9.9 Critical |
| A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launching a crafted image, to overwrite arbitrary files on the host system as root. When processing target template paths specified in metadata.yaml, LXD validates the path against a confined os.Root directory handle but subsequently opens and creates the file using os.Create with an unconfined string path. This discrepancy between path resolution checks and file creation allows an attacker to escape directory confinement, overwrite root-owned host files, and achieve host root code execution. | ||||
| CVE-2026-77113 | 1 Canonical | 1 Apport | 2026-08-21 | N/A |
| Path traversal in apport-unpack in Canonical Apport before 2.36.0, 2.34.2, and 2.28.4 on Linux allows an attacker to create or overwrite arbitrary files with the privileges of the executing user via an attacker controlled key names in crash report files. | ||||
| CVE-2026-21082 | 2 Samsung, Samsung Mobile | 2 Health, Samsung Health | 2026-08-19 | 5.5 Medium |
| Relative path traversal in Samsung Health prior to version 7.0.0 allows local attackers to access sensitive information. | ||||
| CVE-2026-62837 | 1 Microsoft | 5 Sharepoint Enterprise Server 2016, Sharepoint Server, Sharepoint Server 2016 and 2 more | 2026-08-17 | 6.5 Medium |
| Relative path traversal in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network. | ||||
| CVE-2026-70337 | 1 Microsoft | 1 Powershell | 2026-08-14 | 8.8 High |
| Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-65810 | 1 Microsoft | 15 .net, .net Framework, Windows 10 1607 and 12 more | 2026-08-14 | 7.8 High |
| Relative path traversal in .NET Framework allows an unauthorized attacker to elevate privileges locally. | ||||
| CVE-2026-58481 | 2 Jovancoding, Network-ai | 2 Network-ai, Network-ai | 2026-08-13 | 6.5 Medium |
| Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `AgentRuntime` promises scoped file access under a configured sandbox `basePath`, but its path containment checks use raw string prefix tests. A sandbox base such as `/tmp/network-ai-sandbox` also matches a sibling path such as `/tmp/network-ai-sandbox_evil/secret.txt`. An agent/user that can call `AgentRuntime.readFile()` or `AgentRuntime.listDir()` can read or list files outside the intended sandbox when the target path is in a sibling directory sharing the base path prefix. This breaks the documented sandbox boundary. The issue is fixed in v5.12.2. `SandboxPolicy.resolvePath()` and `isPathAllowed()` now use separator-anchored prefix checks (`resolved === base || resolved.startsWith(base + path.sep)`) for both the allow-list and block-list. A sibling directory that merely shares a name prefix (e.g. `/srv/app-evil` vs base `/srv/app`) is no longer treated as in-scope. | ||||
| CVE-2026-58413 | 2 Jovancoding, Network-ai | 2 Network-ai, Network-ai | 2026-08-13 | 6.1 Medium |
| Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentManager.restore(env, backupId)` computes the backup path with `join(envDir, '.backups', backupId)` and only checks that this path exists. It does not resolve the result or verify that it remains under `data/<env>/.backups`. A caller can pass a traversal backup ID such as `../../../outside/source-dir` to restore files from an arbitrary directory into the target environment data directory. The issue is fixed in v5.12.2. `restore()` now validates `backupId` against `/^[\w\-]+$/` and asserts `dirname(resolve(join(backupsDir, backupId))) === resolve(backupsDir)` before touching the filesystem. Backup IDs containing path separators or `..` are rejected, so a crafted ID can no longer copy directories from outside `.backups/` into the environment. | ||||
| CVE-2026-53416 | 1 Zoom Communications | 1 Zoom Vdi | 2026-08-13 | 7.1 High |
| Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access. | ||||
| CVE-2026-16230 | 2 Strategy11, Wordpress | 2 Formidable Digital Signatures, Wordpress | 2026-08-13 | 9.8 Critical |
| The Formidable Digital Signatures plugin for WordPress is vulnerable to file deletion due to insufficient file path validation in the delete_file function in all versions up to, and including, 3.0.6. This makes it possible for unauthenticated attackers to delete files on the server by supplying an attacker-controlled filename in the item_meta[field_id][content] parameter alongside the delete_saved_image flag during the standard entry-creation POST flow on any form that accepts anonymous submissions. | ||||
| CVE-2026-14903 | 1 Ivanti | 1 Xtraction | 2026-08-12 | 7.7 High |
| Path traversal in Ivanti Xtraction before version 2026.2.1 allows a remote authenticated attacker to read arbitrary files outside the web root. | ||||
| CVE-2026-16053 | 1 Zohocorp | 2 Manageengine M365 Manager Plus, Manageengine M365 Security Plus | 2026-08-11 | 8.5 High |
| Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module. | ||||
| CVE-2026-10595 | 1 Parisneo | 1 Parisneo/lollms | 2026-08-10 | N/A |
| A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`. The vulnerability arises from the improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization or containment checks. URL-encoded dot-dot sequences (`%2e%2e`) bypass Starlette's built-in path normalization and are resolved by Python's `pathlib`, allowing an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3. | ||||
| CVE-2023-38185 | 1 Microsoft | 2 Exchange Server, Exchange Server 2016 | 2026-08-10 | 8.8 High |
| Microsoft Exchange Server Remote Code Execution Vulnerability | ||||
| CVE-2023-35359 | 1 Microsoft | 19 Windows 10 1507, Windows 10 1607, Windows 10 1809 and 16 more | 2026-08-10 | 7.8 High |
| Windows Kernel Elevation of Privilege Vulnerability | ||||
| CVE-2026-56794 | 1 Dell | 5 Dell Openmanage Server Administrator Managed Node (patch) For Windows, Dell Openmanage Server Administrator Managed Node For Rhel 8.10, Dell Openmanage Server Administrator Managed Node For Rhel 9.4 and 2 more | 2026-08-08 | 6.5 Medium |
| Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. | ||||