#cwe-22

共收录 2626 条相关情报。

漏洞预警2026-09-05 发布INFO

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3.8 via the 'remoteurl' parameter. This makes it possible ...

CVE-2026-14975

The WP File Download plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.3

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

安全公告2026-09-04 发布INFO

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and...

CVE-2026-81939

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing func

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-22 #severity:critical

漏洞预警2026-09-04 发布INFO

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an attacker to extract files outside the...

CVE-2026-81939

A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing func

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchive::extractTo() without validating ent...

CVE-2026-53757

Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP e

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug values with the OpenAPI/huma tag pattern:"[a-z0-9-]+". huma ...

CVE-2026-50553

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug val

历史摘要 · 未重新核验 · NVD

#cve #cwe-20 #cwe-22

安全公告2026-09-04 发布INFO

CodeWhale: Project config `instructions` override enables arbitrary file read into AI system prompt via cloned repository

CVE-2026-75859

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #npm #cwe-22 #cwe-200 #severity:high

安全公告2026-09-04 发布INFO

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

CVE-2026-75914

### Maintainer resolution The CodeWhale maintainers validated this report. The affected package ranges are recorded in

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #rust #npm #cwe-22 #cwe-59 #severity:high

安全公告2026-09-04 发布INFO

Note Mark: Path traversal via unsanitized book/note slug in migrate export (sibling of GHSA-g49p)

CVE-2026-50553

Note Mark is an open-source note-taking application. Prior to version 0.19.5, Note Mark validates book and note slug val

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-20 #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted direct...

CVE-2026-17622

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot...

CVE-2026-17621

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker c

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request contain...

CVE-2026-14470

IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An at

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material (secret_key, JWT sig...

CVE-2026-19306

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesyste

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a re...

CVE-2026-19303

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or dir

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

CVE-2026-19302

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal.

CVE-2026-19299

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the server due to improper input validation in the SaveToFileCom...

CVE-2026-9138

IBM Langflow OSS 1.0.0 through 1.11.2 Langflow could allow an authenticated attacker to write arbitrary files to the ser

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influence mode...

CVE-2026-85690

Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files ou

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an uncon...

CVE-2026-85685

AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segme...

CVE-2026-85665

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitr

历史摘要 · 未重新核验 · NVD

#cve #cwe-22

漏洞预警2026-09-04 发布INFO

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply...

CVE-2026-85661

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attacker

历史摘要 · 未重新核验 · NVD

#cve #cwe-22