#cwe-22

共收录 2626 条相关情报。

← 返回所有主题
漏洞预警2026-09-10 发布INFO

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information due to an absolute-path traversal vulnerability.

CVE-2026-81554

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to obtain sensitive information

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delete files on shared storage due to a path traversal vulnera...

CVE-2026-81551

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to arbitrarily write to or delet

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belonging to other tenants due to a path traversal vulnerability.

CVE-2026-81540

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to overwrite ruleset files belon

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to path traversal during archive extraction.

CVE-2026-80424

IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to create arbitrary files due to

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()` writes an embedded smart object to a path taken verbatim ...

CVE-2026-49836

psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to version 1.17.1, `SmartObject.save()`

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.16 and 8.0.5, a malicious rule could ...

CVE-2026-45767

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Pr

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local files via a POST Request in a public url.

CVE-2025-57231

Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to disclose local file

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v8. Due to insufficient validatio...

CVE-2026-76652

An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2,

历史摘要 · 未重新核验 · NVD

安全公告2026-09-10 发布INFO

n8n: Git Node branch.<name>.remote Config Key Bypasses Sandbox Path Restriction, Enabling Local Git Repository Read

CVE-2026-86995

## Impact The Git node validated the repository that a fetch or pull targeted, but `setUpstream` wrote a `branch..remot

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-10 发布INFO

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, rclone core does not reject parent-directory segme...

CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attackers to enumerate arbitrary directories on the host files...

CVE-2026-88940

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attac

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Att...

CVE-2026-88938

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agen

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allowing attackers to read and write arbitrary files outside ...

CVE-2026-88937

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allo

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-10 发布INFO

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.0 until 1.75.1, the archive ZIP backend method (*Fs).read...

CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.

历史摘要 · 未重新核验 · NVD

安全公告2026-09-10 发布INFO

rclone: source object names can escape the configured root on upload

CVE-2026-88046

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-10 发布INFO

rclone archive/zip: Zip Slip via unsanitized zip entry names lets a malicious archive escape its own namespace

CVE-2026-88014

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.72.

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-10 发布INFO

knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint

CVE-2026-88939 · CVE-2026-88940

knowns through 0.33.0 fails to validate the path query parameter in the workspace browse endpoint, allowing remote attac

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-10 发布INFO

knowns through 0.33.0 Path Traversal via code.find MCP tool

CVE-2026-88938

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agen

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-10 发布INFO

knowns through 0.33.0 Path Traversal via Template Engine

CVE-2026-88937

knowns through 0.33.0 fails to properly validate template destination paths in the code generation template engine, allo

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-10 发布INFO

Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce <= 3.1.6 versions.

CVE-2026-81789

Unauthenticated Arbitrary File Deletion in Advanced Product Fields Extended for WooCommerce <= 3.1.6 versions.

历史摘要 · 未重新核验 · NVD