Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauthenticated network attacker to write arbitrary files to an...

CVE-2026-11420

Two path traversal vulnerabilities in the Network Installation Service (NIS) of Altium Enterprise Server allow an unauth

历史摘要 · 未重新核验 · NVD

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper validation of a user-controlled path component in image uplo...

CVE-2026-11419

A path traversal vulnerability exists in the Altium Enterprise Server Vault Service UploadController due to improper val

历史摘要 · 未重新核验 · NVD

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Because the key is identical across all installations, an una...

CVE-2026-11414

A hard-coded cryptographic key is used by Altium Enterprise Server to sign file download URLs in the Vault service. Beca

历史摘要 · 未重新核验 · NVD

skillctl: Path traversal and symlink-follow in skillctl allow arbitrary file disclosure and deletion

## Impact `skillctl` 0.1.0 and 0.1.1 contained four path-safety vulnerabilities that, in combination, allowed an attack

历史摘要 · 未重新核验 · GitHub Advisory

NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated attacker)

CVE-2026-47731

## 1. Summary The Binary Stream Capture (BSC) component exposes an unauthenticated HTTP API for dynamically creating pa

历史摘要 · 未重新核验 · GitHub Advisory

DbGate: Zip Slip in archive/unzip allows arbitrary file write leading to RCE

CVE-2026-47669

The `unzipDirectory()` function in `packages/api/src/shell/unzipDirectory.js` (line 27) does not validate that extracted

历史摘要 · 未重新核验 · GitHub Advisory

NocoDB: Path Traversal via SQLite Source Filename

CVE-2026-47385

### Summary An authenticated user with base-create permission can attach a SQLite source pointing at an arbitrary file o

历史摘要 · 未重新核验 · GitHub Advisory

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting directory traversal in the web serv...

CVE-2026-50234

Lyrion Music Server 9.2.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrar

历史摘要 · 未重新核验 · NVD

browserstack-runner has an unauthenticated arbitrary file read via path traversal in HTTP server

CVE-2026-49144

## Summary The HTTP server in browserstack-runner serves files from the project directory via the `_default` handler. T

历史摘要 · 未重新核验 · GitHub Advisory

Docling Core: Unsafe remote filename resolution

CVE-2026-44023

### Impact In versions `>= 1.5.0, = 2.74.1` ### Workarounds If upgrading is not immediately possible, avoid passing unt

历史摘要 · 未重新核验 · GitHub Advisory

Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands

CVE-2026-44022

### Impact The LaTeX backend's handling of `\includegraphics`, `\input`, and `\include` commands lacked path containment

历史摘要 · 未重新核验 · GitHub Advisory

Docling: Unsafe Zip Extraction in EasyOCR Model Download

CVE-2026-44017

### Impact In versions `< 2.91.0`, The EasyOCR model download functionality extracted ZIP archives without validating me

历史摘要 · 未重新核验 · GitHub Advisory

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows re...

CVE-2024-47273

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functiona

历史摘要 · 未重新核验 · NVD

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 ...

CVE-2024-47263

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository web

历史摘要 · 未重新核验 · NVD

The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient validation of user-supplied input.

CVE-2026-35082

The ugw-logread method allows a remote attacker with user privileges to access arbitrary local files due to insufficient

历史摘要 · 未重新核验 · NVD

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5-2606, the alf.io extension sandbox injects a ful...

CVE-2026-41412

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to versio

历史摘要 · 未重新核验 · NVD

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js that allows unauthenticated network-adjacent attackers to...

CVE-2026-49144

BrowserStack Runner through 0.9.5 contains a path traversal vulnerability in the _default HTTP handler in lib/server.js

历史摘要 · 未重新核验 · NVD

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/packages/packages.toml content. Package keys read from bui...

CVE-2026-43965

Path traversal vulnerability in Gleam's dependency management allows arbitrary directory deletion via malicious build/pa

历史摘要 · 未重新核验 · NVD

Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write outside the intended documentation output directory. Th...

CVE-2026-32685

Path traversal vulnerability in Gleam's handling of custom documentation pages allows arbitrary file read and file write

历史摘要 · 未重新核验 · NVD

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid directory due to a path traversal error....

CVE-2026-0055

In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC)

来源摘录 · NVD