IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traversal.

CVE-2026-17071

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to perform file manipulation due to path traver

历史摘要 · 未重新核验 · NVD

Trigger.dev: Cross-tenant object store read and write via URL path traversal

CVE-2026-73658

Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5,

历史摘要 · 未重新核验 · OSV.dev

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

CVE-2026-12243

# Summary nltk.data.load() and nltk.data.find() resolve user-supplied resource names to filesystem paths using url2pathn

历史摘要 · 未重新核验 · GitHub Advisory

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape...

CVE-2026-48099

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path

历史摘要 · 未重新核验 · NVD

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compliance-trestle library's profile import mechanism resolves ...

CVE-2026-45774

compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the compli

历史摘要 · 未重新核验 · NVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal.

CVE-2026-17043

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to delete arbitrary files due to path traversal

历史摘要 · 未重新核验 · NVD

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary objects due to a path traversal vulnerability.

CVE-2026-16908

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain unauthorized access to arbitrary object

历史摘要 · 未重新核验 · NVD

compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal

CVE-2026-45774

compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compl

历史摘要 · 未重新核验 · OSV.dev

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatc...

CVE-2026-73653

Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider

历史摘要 · 未重新核验 · NVD

WsgiDAV encoded dot segments can escape filesystem share roots

CVE-2026-48099

WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path

历史摘要 · 未重新核验 · OSV.dev

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsaniti...

CVE-2026-67613

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitra

历史摘要 · 未重新核验 · NVD

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitrary path because load_lexicon interpolates the language at...

CVE-2026-13048

Data::MuForm::Localizer versions through 0.05 for Perl execute Perl from a message catalog header, reached at an arbitra

历史摘要 · 未重新核验 · NVD

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename handler in server/handles/fsbatch.go authorizes only the sour...

CVE-2026-73509

OpenList a file list program that supports multiple storage. Prior to 4.2.4, the authenticated /api/fs/batch_rename hand

历史摘要 · 未重新核验 · NVD

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when...

CVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module roo

历史摘要 · 未重新核验 · NVD

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

CVE-2026-70460

rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module roo

历史摘要 · 未重新核验 · OSV.dev

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

The optional dashboard HTTP server (`atomic_agents/dashboard/serve.py`) builds filesystem paths directly from the reques

历史摘要 · 未重新核验 · GitHub Advisory

Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.

CVE-2026-65582

Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.

历史摘要 · 未重新核验 · NVD

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

CVE-2026-61980

Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions.

历史摘要 · 未重新核验 · NVD

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

CVE-2026-28189

Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions.

历史摘要 · 未重新核验 · NVD

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers c...

CVE-2026-73620

GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing

历史摘要 · 未重新核验 · NVD