Export limit exceeded: 18037 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 11231 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (11231 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-115365 | 1 Openbao | 1 Openbao | 2026-10-23 | 6.6 Medium |
| OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows tokens to reference policies from arbitrary namespaces using specially crafted policy names. Attackers holding such tokens can gain capabilities of cached policies in other namespaces, including the root namespace, to act across namespace boundaries. | ||||
| CVE-2026-56834 | 1 Mervinpraison | 1 Praisonai | 2026-10-23 | 7.5 High |
| PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that the supplied artifact_path is an artifact created by the configured store or that it lives under the configured artifact base directory. Instead, artifact_head, artifact_tail, artifact_grep, and artifact_chunk wrap the caller-supplied path directly into an ArtifactRef and then read it from the host filesystem. As a result, any prompt/user/tool-caller that can influence those tool arguments can read files readable by the PraisonAI process, such as project .env files, cloud credentials, SSH keys, source files, or other local data. This issue has been patched in version 4.6.59. | ||||
| CVE-2026-57155 | 1 Opnsense | 1 Core | 2026-10-23 | 9.9 Critical |
| OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the Firewall Alias GeoIP importer's process_zip() and process_gzip() paths in src/opnsense/scripts/filter/lib/alias/geoip.py use an unvalidated CSV country_code value to construct output filenames below /usr/local/share/GeoIP/alias. A user with Firewall Alias Edit privilege can configure an attacker-controlled GeoIP source URL and supply an archive whose country code traverses into another existing directory, causing attacker-controlled content to be written as root with an -IPv4 or -IPv6 suffix. A crafted newsyslog fragment and oversized log file can use the default hourly root cron job to execute commands as root, resulting in complete firewall compromise. This issue is fixed in version 26.1.11. | ||||
| CVE-2026-115354 | 1 Mistune Project | 1 Mistune | 2026-10-23 | 6.5 Medium |
| Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to read local files by supplying relative or absolute include paths. Attackers who submit Markdown rendered via Markdown.read() can disclose files such as /etc/passwd and inject unescaped HTML or script content into rendered output. | ||||
| CVE-2026-105265 | 1 Kiloview | 1 E3 Firmware | 2026-10-23 | 5.3 Medium |
| A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an authenticated user to cause /etc/localtime to point to a file outside the intended zoneinfo directory . | ||||
| CVE-2026-115497 | 2026-10-23 | 7.5 High | ||
| The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7 via the 'f' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Exploitation requires a valid purchase_id token, which any user can obtain by making a single low-cost purchase or receiving a shared download link. | ||||
| CVE-2026-115355 | 1 Mistune Project | 1 Mistune | 2026-10-23 | 7.5 High |
| Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by supplying ../ sequences in include paths. Attackers can also inject HTML through unescaped error messages and included file contents to perform cross-site scripting even when escape=True is set. | ||||
| CVE-2026-115375 | 2 Linuxcontainers, Lxc | 2 Incus, Incus | 2026-10-23 | 9.9 Critical |
| Incus 7.0.0 before 7.0.2 and 7.1.0 before 7.5.0 contains a path traversal vulnerability that allows clients able to create instances to write files on the host. The flaw stems from unvalidated dependent custom volume names in instance backup index.yaml files. Attackers can import a crafted instance backup with ../ sequences in dependent volume names to create root-owned directories with controlled content, leading to full host compromise. | ||||
| CVE-2026-85518 | 1 Redhat | 2 Enterprise Linux, Hummingbird | 2026-10-23 | 6.1 Medium |
| A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process. | ||||
| CVE-2026-90458 | 1 Openstack | 1 Ironic | 2026-10-23 | 5.4 Medium |
| OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service. | ||||
| CVE-2026-75887 | 1 Redhat | 2 Openshift, Openshift Container Platform | 2026-10-23 | 7.5 High |
| A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json` files from the pod filesystem, including plugin manifests and configuration files. Furthermore, this flaw can enable path traversal against registered dynamic-plugin backends. | ||||
| CVE-2026-115353 | 2 Lepture, Mistune Project | 2 Mistune, Mistune | 2026-10-23 | 8.6 High |
| Mistune before 3.3.0 contains a path traversal vulnerability in the RST include directive that allows attackers to read arbitrary files by supplying relative or absolute paths. Attackers can submit markdown containing include directives referencing ../ sequences or absolute paths to embed sensitive files like credentials or environment data in rendered HTML. | ||||
| CVE-2016-20100 | 1 Memphis Documents Library Project | 1 Memphis Documents Library | 2026-10-23 | 7.5 High |
| Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22. | ||||
| CVE-2014-125134 | 2026-10-23 | 7.5 High | ||
| ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18. | ||||
| CVE-2026-113664 | 1 Apostrophecms | 2 Apostrophecms, Import-export | 2026-10-23 | N/A |
| ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-export module, an authenticated importer can submit a tar entry whose normalized destination targets a directory while bypassing the literal parent-path substring guard. Opening that directory as a write stream emits an unhandled filesystem error that can terminate the Node.js process; the source establishes this static primitive but not an end-to-end exploit or controlled arbitrary file read or write. This issue is fixed in version 3.7.0. | ||||
| CVE-2026-100406 | 1 Dbt-labs | 1 Dbt-core | 2026-10-22 | N/A |
| dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. From 2.0.0-alpha.0 until 2.0.0-alpha.5, dbt docs serve exposes the unauthenticated POST /api/v1/query endpoint in crates/dbt-docs-server/src/handlers/query.rs, which passes caller-supplied SQL to DuckDbViewsBackend::query_arrow() in crates/dbt-index-core/src/backend.rs without authorization or an allowlist. A client that can reach the server can invoke DuckDB filesystem-reading functions to read files available to the dbt process, including files outside the docs index directory. The server binds to localhost by default, but operators can expose it to a network through the host option or DBT_DOCS_HOST setting. This issue is fixed in version 2.0.0-alpha.5. | ||||
| CVE-2026-113394 | 1 Draytek | 2 Vigor2960, Vigor2960 Firmware | 2026-10-22 | 7.4 High |
| A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainfunction.cgi. The manipulation of the argument setSWMProfile leads to path traversal. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor explains: "2960 1.5.1.7 has corrected many security issues. And 2960 is EoS with limited support, only major issues would be reviewed(e.g. unauthenticated vuln.)". This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2026-92153 | 1 Nasa | 1 Fprime | 2026-10-22 | 7.1 High |
| F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0, Svc::FileUplink handling of Fw::FilePacket::StartPacket destination paths FileUplink copies the packet-controlled destinationPath and opens it for writing without canonicalization or confinement to an upload directory. When a peer able to send file-uplink packets supplies an absolute, traversing, or otherwise attacker-selected writable destination path, files can be created or overwritten at attacker-selected writable filesystem locations, affecting integrity and potentially availability. This issue is fixed in version 4.3.0. | ||||
| CVE-2026-65103 | 1 Nvidia | 1 Aistore Framework | 2026-10-22 | 8.1 High |
| NVIDIA AIStore for Linux contains a path traversal vulnerability in the target-side object rename handler, where an unauthenticated remote attacker could cause an improper limitation of a pathname to a restricted directory by submitting a crafted rename destination directly to an AIStore target, resulting in the arbitrary creation or overwrite of a file. A successful exploit of this vulnerability might lead to code execution, escalation of privileges, information disclosure, data tampering, and denial of service. | ||||
| CVE-2026-65161 | 1 Nvidia | 1 Aistore Framework | 2026-10-22 | 7.5 High |
| NVIDIA AIStore for Linux contains a vulnerability in the Promote API where an unauthenticated remote attacker may read files accessible to the target process by supplying a crafted absolute source path. A successful exploit may lead to information disclosure. | ||||