Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
9,658 results · page 7 of 194
Oct 14, 2026Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners.CVE-2026-68957 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 4.3
Gitea's API and web issue-search paths do not treat restricted accounts as anonymous viewers when evaluating Limited-visibility repository owners. A restricted user can search and retrieve issue titles and bodies that should be hidden by the owner's visibility policy. Keyword matching can also reveal that hidden issue content or comments contain a supplied term.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement.CVE-2026-66877 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2High 8.1
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters eCVE-2026-66874 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 6.5
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs.CVE-2026-63792 · Other software · Gitea · reported by 88ee5874-cf24-4952-aea0-31affedb7ff2Medium 5.3
Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository.
- Product
- Gitea
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.gitea.comgithub.com
Oct 14, 2026Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths.CVE-2026-110649 · Other software · shahkashani · reported by VulnCheckCritical 9.3
Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted media file paths. Attackers can name a media file with $(...) or backticks to execute operating system commands with Node.js process privileges when ffmpeg, ffprobe, gifsicle, or convert runs.
- Product
- stills
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values toCVE-2026-110643 · Other software · kky-ykk · reported by VulnCheckCritical 9.3
transcribe2texts through 1.0.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted audioPath values to transcribeAudio(). Attackers can inject $() or backtick substitution or a closing quote into the unescaped path passed to child_process.exec() to run commands with Node.js process privileges.
- Product
- transcribe2texts
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptiCVE-2026-110640 · Other software · ariym · reported by VulnCheckCritical 9.3
Whisper-node through 1.1.1 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted filePath or whisperOptions.language values to whisper(). Attackers can inject shell metacharacters or $() substitution into the command string built by createCppCommand() and run via shelljs exec() to execute commands with Node.js process privileges.
- Product
- whisper-node
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() CVE-2026-110638 · Other software · zepspaiva · reported by VulnCheckCritical 9.3
doc-recog through 1.1.6 contains an OS command injection vulnerability that allows attackers to execute commands by supplying crafted document paths to recog() or tag(). Attackers can embed $(...) or backtick command substitution in the file path, which DocData._readPDF passes to a shell-based pdftotext exec call, running commands with Node.js process privileges.
- Product
- doc-recog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiex_pcie_request_irqCVE-2026-98426 · Computers, phones & browsers · Linux · reported by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: fix IRQ leak using wrong index in MSI-X error path mwifiex_pcie_request_irq() registers each MSI-X vector with a per-index dev_id (&card->msix_ctx[i]). On a request_irq() failure the cleanup loop "for (j = 0; j < i; j++)" frees msix_entries[j].vector but passes the failed index's &card->msix_ctx[i] as the dev_id. free_irq() matches on (irq, dev_id), so it fails to find the action registered with &card->msix_ctx[j]: the already-requested IRQ j is not freed (leaked) and free_irq() warns about freeing a non-existent IRQ. Use &card->msix_ctx[j].
- Product
- Linux
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgit.kernel.orggit.kernel.org
Oct 14, 2026Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at CVE-2026-110690 · Other software · coderaiser · reported by VulnCheckHigh 8.7
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 contains a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler at server/rest/index.js:130 calls the unguarded root() function instead of the root.resolve() validation wrapper used elsewhere. Attackers can send percent-encoded directory traversal sequences in the pack request path to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.
- Product
- cloudcmd
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Oct 14, 2026Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilityCVE-2026-101217 · Other software · Dell · reported by security_alert@emc.comMedium 6.5
Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.
- Product
- Unisphere for PowerMax vApp
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Koha is vulnerable to OS command injection in the Task Scheduler deletion path.CVE-2026-105106 · Other software · Koha Community · reported by 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2cHigh 8.8
Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request parameter for op=cud-delete and passes it to C4::Scheduler::remove_at_job without validating it. Schedule::At::remove substitutes the supplied job ID into an atrm command string without quoting or escaping it and executes the command through a single-argument system() call, which invokes the shell. An authenticated staff user with the tools => schedule_tasks permission can therefore execute arbitrary operating-system commands as the Koha web/application user by supplying shell metacharacters in jobid. The issue is fixed in Koha 24.11.20, 25.05.15, 25.11.09, and 26.05.04, and in the 26.11 development branch.
- Product
- Koha
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.koha-community.orgdownload.koha-community.org
Oct 14, 2026File Upload to Order: Does not validate or confine a file path taken from attacker-controlled session data before deleting the fileCVE-2026-107594 · WordPress plugins & themes · reported by WPScanCritical 10
The File Upload to Order WordPress plugin before 1.1.4 does not validate or confine a file path taken from attacker-controlled session data before deleting the file, and the action that performs the deletion is reachable by unauthenticated users, allowing them to delete arbitrary files on the server, including files whose removal leads to full site compromise.
- Product
- File Upload to Order
- Fixed in
- 1.1.4
- What to do
- Update File Upload to Order to 1.1.4 or newer.
Oct 14, 2026A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create oCVE-2026-110458 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Low 3.7
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.
- Product
- UniFi Protect AI Key
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain iCVE-2026-110457 · Network & remote access · Ubiquiti Inc · reported by fe490ce8-0395-4072-90d8-2707e1bdf984Low 3.7
A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.
- Product
- UniFi Protect AI Key
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 14, 2026Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content CVE-2026-110450 · Other software · NixOS · reported by MITREHigh 8
Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store path before content verification.
- Product
- Nix
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arCVE-2026-103820 · Other software · Adobe · reported by AdobeMedium 5.5
CAI Content Credential is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in an arbitrary file system write. An attacker could leverage this vulnerability to write to unauthorized files or directories outside of intended restrictions. Exploitation of this issue requires user interaction in that a victim must extract a maliciously crafted file.
- Product
- Content Credentials Rust SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file CVE-2026-90530 · Websites & servers · Adobe · reported by AdobeCritical 9.3
ColdFusion RDS is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed. RDS is purely a development feature meant for debugging purposes, and switching ColdFusion to Production Secure Profile automatically disables RDS. The Lockdown Guide outlines the specific step to disable RDS if a ColdFusion server is not being used in Production Secure Profile.
- Product
- ColdFusion 2025
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordguides.adobe.comguides.adobe.com
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary dirCVE-2026-63162 · Other software · Omnispace · reported by VulnCheckHigh 8.7
Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers to write arbitrary files outside the intended temporary directory by supplying an unanchored tmpFolderName value in the upload destination path. Attackers can exploit this flaw, for example by setting tmpFolderName to a traversal sequence targeting the web root, to write attacker-controlled files and achieve remote code execution.
- Product
- Agora Project
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comagora-project.net
Oct 13, 2026Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass.CVE-2026-110084 · Other software · Adobe · reported by AdobeHigh 7.1
Adobe Experience Manager is affected by an XML Injection (aka Blind XPath Injection) vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and limited write access. Exploitation of this issue does not require user interaction.
- Product
- Adobe Experience Manager 6.5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbCVE-2026-106634 · Other software · Adobe · reported by AdobeHigh 7.7
Adobe Experience Manager is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. A low-privileged attacker could leverage this vulnerability to write files to unauthorized locations on the file system. Exploitation of this issue does not require user interaction. Scope is changed.
- Product
- Adobe Experience Manager 6.5 LTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-103847 · Other software · Adobe · reported by AdobeHigh 8.6
Dimension is affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
- Product
- Adobe Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user.CVE-2026-103845 · Other software · Adobe · reported by AdobeHigh 8.6
Dimension is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. A local attacker with user permissions could exploit this vulnerability to execute arbitrary code. Exploitation of this issue requires user interaction in that a victim must run the application. Scope is changed.
- Product
- Adobe Dimension
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a netwCVE-2026-102238 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comCritical 9.6
Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- Product
- Visual Studio Code
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.CVE-2026-88136 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper resolution of path equivalence in WebDAV allows an authorized attacker to execute code over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose informatCVE-2026-85932 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.CVE-2026-83923 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Relative path traversal in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-83873 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.CVE-2026-83865 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 4.7
Relative path traversal in Windows Internet (wininet.dll) allows an authorized attacker to perform tampering locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.CVE-2026-83784 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.CVE-2026-83746 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.1
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.CVE-2026-83683 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.CVE-2026-83509 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7
Untrusted search path in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.CVE-2026-83506 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted search path in Servicing Stack Updates allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose informatCVE-2026-70298 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to disclose information over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.CVE-2026-70297 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.
- Product
- Skype for Business Server 2015 CU13
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.CVE-2026-70222 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Relative path traversal in Windows Shell allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 1607
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.CVE-2026-70184 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Improper resolution of path equivalence in Windows Backup Engine allows an authorized attacker to elevate privileges locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.CVE-2026-70161 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an authorized attacker to elevate privileges locally.
- Product
- .NET 10.0 runtime
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.CVE-2026-70142 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted search path in Windows Update Service allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.CVE-2026-69979 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 5.5
Improper protection of alternate path in Windows AppX Deployment Service allows an authorized attacker to bypass a security feature locally.
- Product
- Windows 10 Version 21H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perform tampering over aCVE-2026-69973 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.CVE-2026-69968 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comMedium 6.5
Relative path traversal in Windows Libarchive allows an unauthorized attacker to perform tampering over a network.
- Product
- Windows 10 Version 1809
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code overCVE-2026-69943 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- Product
- Microsoft SharePoint Server Subscription Edition
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.CVE-2026-69923 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Uncontrolled search path element in Windows AI allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 Version 24H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.CVE-2026-69882 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.CVE-2026-69783 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
External control of file name or path in Windows Update allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.CVE-2026-69733 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 7.8
Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
- Product
- Windows 11 version 23H2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursiCVE-2026-110235 · Other software · Abdurazaaq Mohammed · reported by VulnCheckMedium 6.7
MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypassing the non-recursive sanitizeEntryName filter. Attackers can craft TAR, 7z or RAR entries named ....//file that become ../file, creating or overwriting files anywhere the app can write on shared storage.
- Product
- MP Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 13, 2026Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypaCVE-2026-110232 · Other software · Fossify · reported by VulnCheckMedium 4.6
Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extraction folder by bypassing an unanchored startsWith check. Attackers can supply archive entries like ../<name>_x/file to create or overwrite files in sibling folders when a user extracts the archive.
- Product
- Fossify File Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.