Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,982 results · page 6 of 180
Oct 8, 2026HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which CVE-2026-19585 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.3
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
- Product
- Shared library
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function.CVE-2026-103663 · Other software · Ollama · reported by cvd@cert.plCritical 9.4
Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenticated remote attacker can specify a path traversal sequence as a layer digest, causing a malicious binary to be written outside the model store. Critically if the server process has write access to `/usr/lib/ollama` (the default in most Ollama Docker images), an attacker can write the malicious file to that directory. On the next server restart, the file is loaded and executed, resulting in remote code execution as root. This issue was fixed in version 0.35.0.
- Product
- Ollama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploadCVE-2026-102783 · Websites & servers · reported by security@joomla.orgMedium 6.3
Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 - Gridbox contains the same prefix-only containment logic in its site UploaderHelper . The showImage action resolves a request-controlled path, calls that helper, and then returns the image. If image decoding is unavailable or fails, the action streams the file directly. An existing image in a sibling directory such as images-backup can therefore satisfy the current containment test even though it is outside the configured images root. The route restricts the file extension to Gridbox image types, which materially limits the read primitive. The default media root is images ; the effective site setting was not independently verified. No prefix-matching sibling directory was found alongside the site’s images directory. The finding is rated Low rather than presented as arbitrary file disclosure.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal seCVE-2026-85490 · Other software · Brocade · reported by sirt@brocade.comHigh 7.7
When Brocade ASCG before 3.5.0 processes support bundle archives ingested from remote compromised endpoints, the application fails to sanitize path traversal sequences contained within archive entries prior to extraction. An unauthenticated remote attacker capable of sending or intercepting ingested archive files can leverage this flaw to write arbitrary files to restricted locations on the underlying host, potentially leading to remote code execution.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0.CVE-2026-85487 · Other software · Brocade · reported by sirt@brocade.comHigh 8.6
A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion operations.
- Product
- Brocade Active Support Connectivity Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 8, 2026A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a.CVE-2026-5049 · Other software · Brocade · reported by sirt@brocade.comMedium 6.9
A path traversal vulnerability affects the The Zone Alias Import flow feature in Brocade SANnav before 3.0.0a. A local authenticated attacker can write an uploaded content outside the intended directory.
- Product
- Brocade SANnav
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs.CVE-2026-105820 · Other software · HashiCorp · reported by security@hashicorp.comMedium 5.4
Vault's ACL policy cache allowed namespace traversal when policy names contained path traversal constructs. This may allow a token assigned specially crafted policy names to use the capabilities of policies defined in other namespaces, including the root namespace. This vulnerability (CVE-2026-105820) is fixed in Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23. Vault Community Edition does not support namespaces, and is not affected.
- Product
- Vault Enterprise
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write atCVE-2026-101886 · Network & remote access · Cisco · reported by VulnCheckMedium 5.1
Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no permissions to write attacker-controlled files into Jabber's private data directory by exploiting the exported crosslaunch.share activity and an unsanitized display name from a ContentProvider used in file path construction. Attackers can craft a shared content:// URI with a display name containing '../' sequences to place fully attacker-controlled content within directories such as databases/, shared_prefs/, no_backup/, and files/ without user interaction.
- Product
- Jabber for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbst.cisco.complay.google.com
Oct 7, 2026A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)).CVE-2026-42532 · Other software · visidata · reported by talos-cna@cisco.comMedium 5.5
A path traversal vulnerability exists in the EmailSheet extract_parts functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .eml file can lead to arbitrary file write. An attacker can provide a malicious file to trigger this vulnerability.
- Product
- visidata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)).CVE-2026-41958 · Other software · visidata · reported by talos-cna@cisco.comMedium 6.5
A path traversal vulnerability exists in the unzip_http RemoteZipFile extract functionality of VisiData (version(s): dev (commit 38b21f78)). A specially crafted .zip file can lead to arbitrary file write. An attacker can provide a crafted URL to trigger this vulnerability.
- Product
- visidata
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Path traversal vulnerability in the BugTracker.NET file download component.CVE-2026-92533 · Other software · BugTracker.NET · reported by cve-coordination@incibe.esHigh 7.1
Path traversal vulnerability in the BugTracker.NET file download component. The parameter used to specify the file name does not properly validate user-supplied paths. An authenticated remote attacker could enter a manipulated path to access files located outside the intended directory. Successful exploitation could allow the attacker to read system files accessible to the account used by the application.
- Product
- BugTracker.NET
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 7, 2026Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specifiCVE-2026-90466 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6.5
Path traversal of 'trusted_jar_paths' in Impala 4.5.2 allows an attacker-controlled JAR to be loaded via a relative path where the prefix matches a path specified in 'trusted_jar_paths'. The startup flag 'trusted_jar_paths' references URIs for loading files from local or remote filesystems. Path traversal can't override the schema, but can result in loading a JAR that has been uploaded to a different location in that filesystem via Impala DDLs such as CREATE DATA SOURCE and CREATE TABLE. Path traversal can only be used if a trusted path exists, so this attack requires 'trusted_jar_paths' have a non-empty value configured by the Impala admin. Users are recommended to upgrade to version 4.5.3, which fixes this issue.
- Product
- Apache Impala
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orgopenwall.com
Oct 7, 2026Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticatCVE-2026-5703 · Other software · Satel Iberia · reported by cve-coordination@incibe.esHigh 7.1
Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information.
- Product
- SenNet Datalogger Serie 200
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.CVE-2026-97671 · Other software · IBM · reported by psirt@us.ibm.comMedium 6.5
IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.
- Product
- Langflow OSS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operationCVE-2026-106552 · Other software · OpenBSD · reported by MITREMedium 4.2
In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recursive copy operation.
- Product
- OpenSSH
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager.CVE-2026-79809 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 7.3
An unauthenticated path traversal vulnerability exists in an API endpoint of ClearPass Policy Manager. Successful exploitation of this vulnerability allows an unauthenticated remote attacker to influence authorization decisions and be assigned an unintended role.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026An authenticated path traversal vulnerability exists in ClearPass Policy Manager.CVE-2026-79805 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comCritical 9.8
An authenticated path traversal vulnerability exists in ClearPass Policy Manager. Successful exploitation could allow an attacker to read and modify certain files on the underlying operating system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager.CVE-2026-79800 · Other software · Hewlett Packard Enterprise (HPE) · reported by security-alert@hpe.comHigh 8.8
An authenticated path traversal vulnerability exists in the command line interface of ClearPass Policy Manager. Successful exploitation could allow a low-privileged authenticated remote attacker to execute arbitrary code with elevated privileges on the underlying operating system.
- Product
- ClearPass Policy Manager (CPPM)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists.CVE-2026-101153 · Other software · Arista Networks · reported by psirt@arista.comHigh 7.2
On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user with sufficient high privileges could exploit this to extract unintended data from the Sensor.
- Product
- CloudVision Portal
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability.CVE-2026-86360 · Other software · Dell · reported by security_alert@emc.comCritical 9.6
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Filesystem access for attacker. This vulnerability is considered critical because it can be leveraged by an unauthenticated attacker to execute arbitrary code with root privileges. Successful exploitation may allow complete compromise of the vulnerable application and underlying operating system. Dell recommends customers upgrade at the earliest opportunity.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability.CVE-2026-71168 · Other software · Dell · reported by security_alert@emc.comHigh 7.3
Dell System Update, versions prior to 2.3.0.0, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Remote execution.
- Product
- System Update
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java.CVE-2026-95140 · Other software · reported by MITREHigh 7.5
kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and existsFile endpoints accept a "path" parameter that is concatenated into the upload base path without validation, allowing unauthenticated attackers to create arbitrary directories and write arbitrary files outside the intended fileDir root via a crafted multipart request
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions.CVE-2026-105798 · Computers, phones & browsers · microsoft · reported by GitHubHigh 8.7
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html later interpolates into inline Share event handlers. The escapeGroupHtml function leaves apostrophes unchanged, while escapeHtml produces an HTML entity that the browser decodes before JavaScript evaluation, so either path permits the filename to terminate the handler string. An authenticated group Owner, Admin, or DocumentManager can persist script that executes in the SimpleChat origin when another group member clicks Share, allowing access to victim-visible data and actions with the victim session. This issue is fixed in version 0.261.029.
- Product
- simplechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions.CVE-2026-105797 · Computers, phones & browsers · microsoft · reported by GitHubHigh 8.8
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.003 and 0.261.027, an authorization ordering flaw in POST /api/user/plugins allows an authenticated low-privileged user to omit the top-level MCP type so that _reject_non_admin_mcp_stdio skips inspection before the type is restored from metadata. The stored personal action can then reach McpPluginFactory.create_connector, and MCPStdioPlugin.connect starts the attacker-selected operating-system process under the application service identity when the action tool is invoked. Exploitation requires personal plugins to be enabled and governance to permit MCP actions, and it can expose or modify secrets and data available to the service or disrupt the service. This issue is fixed in version 0.261.031.
- Product
- simplechat
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outCVE-2026-105840 · Other software · Uwe Ohse · reported by VulnCheckHigh 7.7
lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM senders to write files outside the current directory using absolute pathnames. Because checkpath() in src/lrz.c only rejects '../' sequences unless built with --enable-pubdir, attackers can send files named with absolute paths to overwrite any file writable by the receiving user.
- Product
- lrzsz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting CVE-2026-105834 · Other software · rundeck · reported by VulnCheckHigh 7.1
Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary server files by setting resources.source.N.config.file to any absolute path. Attackers can retrieve file contents through editProjectNodeSourceFile or the apiSourceGetContent endpoint to obtain database passwords, LDAP bind credentials, and other projects' data.
- Product
- rundeck
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 6, 2026In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain The NDP traversal in mhi_mbim_rCVE-2026-98237 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhi_wwan_mbim: guard against a cyclic NDP chain The NDP traversal in mhi_mbim_rx() only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP, keeps the loop spinning forever on one CPU. Break out when the next NDP offset is not larger than the current one. Verified in a QEMU guest with a fault injector feeding the driver's receive callback an NTB whose single NDP points at itself: the unpatched driver spins in mhi_mbim_rx() with one CPU pinned at 100% and the thread never returns. With this check the loop terminates within one iteration. Changes in v2: move the non-increasing check to the wNextNdpIndex retrieval site, as suggested by Loic Poulain, instead of tracking the previous offset in a separate variable.
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 5, 2026In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to triggeCVE-2026-0482 · Other software · AMD · reported by psirt@amd.comMedium 5.4
In AMD Versal™ Adaptive SoC devices, insufficient boundary checks in USB boot mode—when enabled through board modifications—could allow crafted images to trigger a buffer overflow and overwrite an active function pointer, which may result in arbitrary code execution during boot process. This condition could lead to potential impacts on confidentiality, integrity, and availability.
- Product
- Alveo™ Accelerator Cards
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Feehi CMS 2.1.1 is vulnerable to Directory Traversal.CVE-2026-95264 · Other software · reported by MITREMedium 6.5
Feehi CMS 2.1.1 is vulnerable to Directory Traversal. An authenticated backend user with article edit permission can delete arbitrary files writable by the PHP process. Article image metadata is used to construct a filesystem path and is passed to `unlink()` without path traversal or directory validation.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private KeyCVE-2026-78861 · Other software · reported by MITREHigh 7.7
An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026ApiAdmin v5.0 and before is vulnerable to Directory Traversal.CVE-2026-88396 · Other software · reported by MITREHigh 7.2
ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the uploaded file's extension verbatim there is no whitelist, blacklist or content check and move_uploaded_file() drops the file into the web-accessible directory public/upload/Ymd/. Any logged-in admin user can upload a .php file and reach it directly over HTTP, achieving remote code execution on the server.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026WookTeam v1.6.6 and before is vulnerable to a Directory Traversal.CVE-2026-88394 · Other software · reported by MITREHigh 7.5
WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an arbitrary file from the server when the data parameter is supplied with a crafted JSON payload. The file value inside the JSON is concatenated directly into storage_path($file) without any path normalization or directory boundary check, so directory traversal (../) escapes the storage/ directory and response()->download() streams any file readable by the web server process.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local().CVE-2026-88392 · Other software · reported by MITREHigh 7.5
Unimall v4 is vulnerable to Directory Traversal in FileUploadController.local(). This allows an attacker to execute arbitrary code.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory.CVE-2026-104806 · Email & office · Mitel · reported by vulnerability@ncsc.chMedium 5.5
DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management portal listening on TCP port 443. The application fails to properly validate user-supplied file paths, allowing an attacker to manipulate the requested path and traverse the underlying directory structure. By exploiting this vulnerability, an attacker can access and download files located outside the intended system logs directory, including potentially sensitive system and application files.
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus ACVE-2026-104706 · Email & office · Mitel · reported by vulnerability@ncsc.chHigh 8.4
DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs
- Product
- Mitel MiVoice Office 400
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 5, 2026Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call.CVE-2026-105314 · Other software · Papermerge · reported by MITREHigh 7.5
Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file can be written to site-packages, and its code is executed upon the next start of the Python interpreter.
- Product
- Papermerge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 4, 2026Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory CVE-2026-105293 · Other software · Legcord · reported by VulnCheckCritical 9.2
Legcord 1.1.0 through 1.3.0 contains a path traversal vulnerability in theme IPC handlers that allows script in the Discord page to escape the themes directory via unvalidated theme ids. Attackers running script in the Discord origin, such as through XSS, can abuse themes.folder, themes.uninstall, and themes.install to launch local executables, recursively delete directories, and write files outside the themes directory.
- Product
- Legcord
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 3, 2026LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segCVE-2026-105125 · Other software · laradashboard · reported by VulnCheckMedium 6.3
LaraDashboard before 1.4.8 contains a path traversal vulnerability that allows unauthenticated attackers to read JSON files by manipulating the {lang} route segment. On Windows hosts, attackers can send URL-encoded backslash sequences like ..%5C to escape resources/lang and read composer.json or other application JSON files.
- Product
- laradashboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files.CVE-2026-104478 · Other software · getformwork · reported by VulnCheckHigh 7.1
Formwork before 2.3.13 contains a path traversal vulnerability in BackupController that allows authenticated panel users to read or delete arbitrary files. Attackers with backup download or delete permission can supply a base64-encoded backslash-separated traversal payload that bypasses PHP basename on Linux to access files outside the backup directory.
- Product
- formwork
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root.CVE-2026-104994 · Other software · aquasec · reported by MITRELow 2.5
Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The risk occurs when using misconf scanning on untrusted input (e.g., upon a third-party pull request that contains a Terraform configuration), if sensitive data can be found at those unintended pathnames, and an adversary can then view a sensitive data value within scan output.
- Product
- Trivy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrarCVE-2026-51907 · Other software · reported by MITREHigh 8.1
In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project_id parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 2, 2026In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images toCVE-2026-51906 · Other software · reported by MITRECritical 9.1
In TaskingAI v0.3.0 in the DALL-E 3 image generation tool save_url_image function, a path traversal vulnerability allows attackers to write downloaded images to arbitrary locations on the server filesystem by manipulating the project_id parameter.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 2, 2026Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configuCVE-2026-103648 · Other software · demsking · reported by cve@gitlab.comCritical 9.1
Path traversal in image-downloader 4.3.0 allows an attacker who can control the download URL to cause downloaded response data to be written outside the configured destination directory.
- Product
- image-downloader
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability.CVE-2026-104721 · Other software · QOS.CH Sarl · reported by vulnerability@ncsc.chMedium 6.3
Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More specifically, an MDC-based discriminator value flows unsanitized into a nested FileAppender path, letting an attacker who influences that MDC value (e.g. via an HTTP header) create and append log files outside the intended directory. This issue affects Logback-classic: from 0.9.14 through 1.6.4. This vulnerability is similar to CVE-2026-19880 but involves other attack techniques.
- Product
- Logback-classic
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON CVE-2026-104417 · Other software · TryGhost · reported by VulnCheckMedium 6.9
Ghost from 1.20.0 before 6.64.0 contains a path traversal vulnerability in theme translation file loading that allows authenticated administrators to read JSON files outside the active theme directory. Attackers can manipulate the locale setting to load JSON files elsewhere on the server, exposing server configuration secrets.
- Product
- Ghost
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 2, 2026Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc.CVE-2026-63573 · Other software · Legion of the Bouncy Castle Inc. · reported by 91579145-5d7b-4cc5-b925-a0262ff19630High 8.2
Observable discrepancy in the CMS RSA PKCS#1 v1.5 key-transport unwrap (KeyTransRecipientInformation.UnwrapKey) in Legion of the Bouncy Castle Inc. bc-csharp before 2.7.0 allows a remote attacker who holds a captured CMS EnvelopedData message, and who can submit many modified messages to an application that decrypts them with the recipient's RSA private key and reveals how decryption failed, to recover the captured message's content-encryption key and so its content, via a Bleichenbacher-style adaptive chosen-ciphertext attack, because a key-transport ciphertext with invalid PKCS#1 v1.5 padding is rejected during unwrap with a distinct "bad padding in message." CmsException instead of being replaced by a random key, so it can be told apart from a correctly padded ciphertext, which fails only later at content decryption.
- Product
- bc-csharp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 2, 2026Super Forms – Drag & Drop Form Builder: Directory TraversalCVE-2026-15896 · WordPress plugins & themes · reported by WordfenceCritical 9.1
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.316 via the parse_request function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The optional 'file_upload_auth' setting defaults to empty, meaning no authentication is required in the default configuration; enabling this setting mitigates unauthenticated exploitation but does not remediate the path traversal itself. Exploitation on Linux requires a real 13-digit timestamp directory to exist, whereas on Windows the traversal works with any hardcoded 13-digit prefix. However, the plugin's file upload response returns the name of the created directory, which means the vulnerability is exploitable as long as file upload is enabled on the form.
- Product
- Super Forms – Drag & Drop Form Builder
- Affected
- up to 6.3.316
- What to do
- Affects up to 6.3.316. Update Super Forms – Drag & Drop Form Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordgithub.comwordfence.com
Oct 1, 2026Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directoryCVE-2025-71427 · Other software · GongRzhe · reported by VulnCheckHigh 7.6
Office-PowerPoint-MCP-Server through 2.0.7 contains a path traversal vulnerability that allows MCP callers to write and read files outside the working directory by supplying absolute paths or ../ sequences. Attackers can steer an AI agent via prompt injection to abuse save_presentation, open_presentation, or manage_image output_path to overwrite any server-writable file or load external files.
- Product
- Office-PowerPoint-MCP-Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack.CVE-2026-71453 · Other software · Johnson Controls · reported by productsecurity@jci.comMedium 5.6
- External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO FS32: before 3.0b63.
- Product
- EasyIO FS32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 1, 2026langflow-ai langflow v1.8.4 is affected by: Directory Traversal.CVE-2026-51888 · Other software · reported by MITREHigh 7.5
langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or storage boundary.. The component is: src/backend/base/langflow/api/v1/knowledge_bases.py:knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge-base. The attack vector is: Attack surface: HTTP or browser-backed service path. A public-facing upload or HTTP route handler forwards an attacker-controlled path or filename into host file creation without any visible boundary enforcement. ¶¶ A weakness has been identified in langflow-ai langflow up to 1.8.4. langflow contains an absolute path traversal vulnerability in knowledge_bases-create_knowledge_base-a-live-http-post-to-create-knowledge-base (src/backend/base/langflow/api/v1/knowledge_bases.py:51). An attacker can write or overwrite files outside the intended working directory by providing absolute paths in the knowledge base creation endpoint.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.