#cwe-22

共收录 2611 条相关情报。

漏洞预警2026-10-29 发布CRITICAL

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before using it to read and delete files, allowing users with min...

CVE-2026-113617

The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before u

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布MEDIUM

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON command handler, `Cmd_UpdateDevices` in ...

CVE-2026-75520

Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the

来源摘录 · NVD

#cve #cwe-22 #cwe-862

安全公告2026-10-28 发布INFO

Backstage catalog rules can be bypassed for URL locations using encoded path segments

CVE-2026-115923

## Summary `@backstage/plugin-catalog-backend` matches URL-type locations against `catalog.rules` location patterns usi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #npm #severity:medium

漏洞预警2026-10-28 发布HIGH

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component, which allows an ...

CVE-2026-93851

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the target post ID in the Age

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布MEDIUM

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories outside the password store via ../ ent...

CVE-2026-118756

gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布MEDIUM

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From langgraph-sdk 0.4.0 until 0.4...

CVE-2026-118667

LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs fro

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布CRITICAL

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, five debug/test PHP scripts under `admin/` perform privile...

CVE-2026-63190

FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, f

来源摘录 · NVD

#cve #cwe-200 #cwe-22 #cwe-288 #cwe-306 #cwe-79

漏洞预警2026-10-28 发布MEDIUM

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after route matching and serve a file through a public static route...

CVE-2026-118654

Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Echo's static file handlers can normalize dot segments after rout

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布MEDIUM

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath denylist. Attackers can invoke importStdMd with a GLOBAL...

CVE-2026-118680

SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the IsSensitivePath

来源摘录 · NVD / GitHub Advisory

#advisory #cve #cwe-22 #severity:medium

漏洞预警2026-10-28 发布HIGH

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installati...

CVE-2026-118619

Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote a

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布HIGH

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Session Smart Router and Session Smart Conductor allows an aut...

CVE-2026-103407

An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Juniper Networks Sessi

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布HIGH

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated flow route parameters from `GET /api/flows/:id` and `DELE...

CVE-2026-59179

OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` passes unauthenticated

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布INFO

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scripts, allowing the added directories to escape the base fol...

CVE-2026-105420

Wing FTP Server does not verify user's base folder. An attacker with admin privileges can add user directories via scrip

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布INFO

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the Convert and Merge AI agent tools allows an authenticated ...

CVE-2026-118038

In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal vulnerability in the

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布INFO

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1....

CVE-2026-86388

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布INFO

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20...

CVE-2026-86383

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release versions 8.3.1.0 through 8.

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: bef...

CVE-2026-105457

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布HIGH

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1....

CVE-2026-86398

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布MEDIUM

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via the 'tmp_file' parameter parameter. This makes it possible...

CVE-2026-104743

The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.0 via t

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-28 发布HIGH

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.1.2 via the process_che...

CVE-2026-15323

The Product Designer for WooCommerce WordPress | Lumise plugin for WordPress is vulnerable to Directory Traversal in all

来源摘录 · NVD

#cve #cwe-22