Tag: path-traversal
22 entries tagged path-traversal, latest activity first.
- Adobe Connect (Windows) APSB26-191: five unauthenticated flaws rated CVSS 10.0 and two more unauthenticated rows among 24 fixes in 12.12 and earlier; Adobe knows of no exploitation
- CVE-2026-13684 / CVE-2026-13639, Synology DSM: two unauthenticated CVSS 9.8 flaws (SCGI output-encoding bug, login-logic entropy weakness) allow remote arbitrary file read/write and denial-of-service with no credentials; C3RB3R ransomware is now encrypting NAS on outdated DSM
- VMSA-2026-0006, VMware vCenter: unauthenticated Directory Service auth bypass and Syslog traversal RCE (both CVSS 9.8), plus a VMXNET3 guest-to-host escape
- CVE-2026-21589, Atlassian Data Center: unauthenticated arbitrary file access in every version of eight self-managed products, patch or take them off the internet (CVSS 4.0 9.3)
- CVE-2026-76519, Cisco Secure Email Gateway: one crafted email attachment writes files and runs commands as root, exploited in the wild and listed in CISA KEV (CVSS 9.8)
- CVE-2026-85706, GitLab CE/EE: unauthenticated path traversal in the repository commits API reads arbitrary server files, and honeypots recorded probes by the day after the patch (CVSS 10.0)
- CVE-2026-104286, Fortinet FortiMail: unauthenticated path traversal file write exploited as a zero-day, fixed in 8.0.2, 7.6.7 and 7.4.9 (CVSS 9.8)
- CVE-2026-87902, WordPress Core: unauthenticated page-template path traversal to conditional remote code execution, weaponised within a day (CVSS4.0 9.2)
- JFrog Artifactory: authenticated Docker-cache path traversal (CVE-2026-66384) added to CISA KEV, a CI/CD artifact-store write primitive with no published exploitation narrative
- Thirteen CVEs in ATutor, none of which will ever be fixed, including an unauthenticated auto-login token forgery that authenticates as any account, administrators included
- Abacus ERP: unauthenticated RCE (CVSS 9.8, no CVE) and authenticated path traversal in a widely-deployed Swiss ERP platform, flagged by NCSC-CH
- Progress orders ShareFile Storage Zone Controller shutdown over a 'credible external threat'; the cause is a path-traversal flaw, fixed in 5.12.5 and 6.0.2
- CVE-2026-61500, Rejetto HFS < 3.2.1: predictable session-signing PRNG lets an unauthenticated attacker forge admin sessions to RCE (CVSS 9.3)
- CVE-2026-56291, Balbooa Forms for Joomla: unauthenticated file-upload RCE exploited as a zero-day (CVSS 10.0)
- Ubiquiti UniFi SAB-066, 25 vulnerabilities incl. unauthenticated CVSS 10.0 command injection in UniFi Connect (CVE-2026-50746)
- CVE-2026-48276, -48277, -48281, -48282, -48283, -48316, Adobe ColdFusion: six CVSS 10.0 unauthenticated RCE paths
- CVE-2026-14439, Altium Enterprise Server / Altium 365: authenticated path-traversal to RCE
- CVE-2026-20262: Cisco Catalyst SD-WAN Manager authenticated arbitrary file write, exploited and KEV-listed; Cisco says a written file could later be used to gain root
- CVE-2026-5027, Langflow: unauthenticated path traversal to arbitrary file write, exploited in the wild
- Mautic 7.1.2 / 6.0.9, seven authenticated flaws, including two post-auth RCE paths (SSTI and path-traversal-to-PHP-RCE), an SSRF and an API authorization bypass
- SEPPmail Secure E-Mail Gateway: unauthenticated code execution and five more flaws in NCSC-CH's advisory (CVE-2026-44128 et al., CVSS up to 9.3), fixed by 15.0.4
- CVE-2026-41553: DHTMLX PDF Export Module executes JavaScript injected into its data parameter without authentication (CVSS 4.0 10.0), with two file-read flaws (CVE-2026-41552, CVE-2026-7182)