Cyber Security Daily Radar

#cwe-22

共收录 2701 条相关情报。

← 返回所有主题
漏洞预警2026-08-03 发布INFO

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. This issue affects Apache Jena Fuseki: through 6.1.0. Users...

CVE-2026-61372

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Jena Fuseki. Thi

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
安全公告2026-08-03 发布INFO

PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset

CVE-2026-69153

## Summary The fix for GHSA-6g55-p6wh-862q added a guard in `lib/previous-map.js` `PreviousMap.loadFile()` that restric

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-22#cwe-200#severity:medium
漏洞预警2026-08-03 发布INFO

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in the bmx7-info CGI script that allows unauthenticated atta...

CVE-2026-69095

OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path traversal vulnerability in

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-08-03 发布INFO

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image argument to RocketTheme\Toolbox\ResourceLocator\UniformR...

CVE-2026-69089

Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes its unsanitized $image

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-08-03 发布INFO

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints, allowing attackers to construct traversal paths that esc...

CVE-2026-69086

SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute-view read endpoints,

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
安全公告2026-08-02 发布INFO

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform...

CVE-2026-9856

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes vi

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-22#severity:high
漏洞预警2026-08-02 发布INFO

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes via path traversal. The issue resides in the `save_pretrain...

CVE-2026-9856

A vulnerability in huggingface/transformers versions <=5.8.0.dev0 allows an attacker to perform arbitrary file writes vi

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-08-02 发布INFO

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` ...

CVE-2026-9335

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improp

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
安全公告2026-08-02 发布INFO

Improper Handling of HDF5 ExternalLinks in keras-team/keras

CVE-2026-9335

A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improp

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-22
安全公告2026-08-02 发布INFO

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions...

CVE-2026-18352

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including,

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-22#severity:high
安全公告2026-08-02 发布INFO

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up...

CVE-2026-13339

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-22#severity:high
漏洞预警2026-08-02 发布HIGH

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This mak...

CVE-2026-18352

CVE-2026-18352 是 WordPress 插件 User Access Manager 所有版本（含 2.3.15）中存在的一个目录遍历漏洞。攻击者可通过构造恶意的 'uamgetfile' 参数，在未认证的情况下读取服务器上的

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-08-02 发布HIGH

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.30 via the 'cubewp_get_svg_content' function. This makes...

CVE-2026-13339

CVE-2026-13339 是 WordPress 插件 CubeWP Framework 中存在的一个目录遍历漏洞，影响所有版本直至并包括 1.1.30。漏洞位于 cubewp_get_svg_content 函数中，由于该函数在处理

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
安全公告2026-08-01 发布INFO

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes...

CVE-2026-67309

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-22#severity:high
安全公告2026-08-01 发布INFO

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection...

CVE-2026-67295

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-22#severity:medium
漏洞预警2026-08-01 发布INFO

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider's RewriteTarget middleware (generated from the nginx.ing...

CVE-2026-67309

Traefik versions >= v3.7.0 and <= v3.7.7 contain a path traversal vulnerability in the Kubernetes Ingress NGINX provider

历史摘要 · 未重新核验 · NVD

#cve#cwe-22
漏洞预警2026-08-01 发布MEDIUM

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access prefix-sibling paths outside the configured share...

CVE-2026-67295

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to

来源摘录 · NVD

#cve#cwe-22
安全公告2026-08-01 发布INFO

FreeRDP before 3.29.0 Path Traversal via drive redirection

CVE-2026-67295

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-22
安全公告2026-08-01 发布INFO

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file...

CVE-2026-15450

The Nex Forms – Ultimate Form Builder – Lite plugin for WordPress is vulnerable to arbitrary file deletion via path trav

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#cwe-22#severity:high
漏洞预警2026-08-01 发布INFO

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zip Slip) in all versions up to, and including, 6.0.13 via ...

CVE-2026-15601

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Path Traversal (Zi

历史摘要 · 未重新核验 · NVD

#cve#cwe-22