Export limit exceeded: 10399 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (10399 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14470 | 1 Ibm | 1 Langflow Oss | 2026-09-04 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. | ||||
| CVE-2026-17621 | 1 Ibm | 1 Langflow Oss | 2026-09-04 | 5.4 Medium |
| IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot " sequences ( /.. /) to view arbitrary files on the system. | ||||
| CVE-2026-17622 | 1 Ibm | 1 Langflow Oss | 2026-09-04 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-85690 | 1 Plandex-ai | 1 Plandex | 2026-09-04 | 7.8 High |
| Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project directory. Attackers can influence model output through poisoned repository files or attacker-controlled context to write to arbitrary locations like shell rc or cron files, achieving code execution. | ||||
| CVE-2026-85685 | 2026-09-04 | 7.5 High | ||
| AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories into the agent workspace via an unconfined source path parameter. Attackers can supply any directory path in the skill_path request parameter to copy files into the skills directory, making them accessible through the workspace skill listing. | ||||
| CVE-2026-79707 | 1 Google Cloud | 1 Agent Development Kit (adk) | 2026-09-04 | N/A |
| A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python allows an unauthenticated remote attacker to read arbitrary files using a crafted file_path query parameter. | ||||
| CVE-2026-74236 | 1 Gfi Software | 1 Gfi Exinda Ai | 2026-09-04 | 6.5 Medium |
| GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_email_file() function accepts parameters prefixed with v_file_row_ and appends their values directly to a base directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can delete arbitrary files from the system in the context of root. | ||||
| CVE-2026-74235 | 1 Gfi Software | 1 Gfi Exinda Ai | 2026-09-04 | 4.9 Medium |
| GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. The wcf_handle_download() function accepts parameters prefixed with v_del_ and appends their values directly to the base configuration directory path without sanitizing for directory traversal sequences. An authenticated attacker with Admin privileges can read arbitrary files from the system in the context of root. | ||||
| CVE-2026-19303 | 1 Ibm | 1 Langflow Oss | 2026-09-04 | 8.1 High |
| IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to delete arbitrary local files or directories due to improper limitation of a pathname to a restricted directory. | ||||
| CVE-2026-82193 | 2 Wordpress, Wpvividplugins | 2 Wordpress, Wpvivid — Backup, Migration & Staging | 2026-09-04 | 5.5 Medium |
| The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.134 does not validate a user supplied file name before using it to build a write path, allowing administrators to write files of permitted types to arbitrary locations on the server and to overwrite existing files. | ||||
| CVE-2026-85661 | 1 Haris-musa | 1 Excel-mcp-server | 2026-09-04 | 9.8 Critical |
| excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process. | ||||
| CVE-2026-19299 | 1 Ibm | 1 Langflow Oss | 2026-09-04 | 6.5 Medium |
| IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to path traversal. | ||||
| CVE-2026-85606 | 1 Firecrawl | 1 Firecrawl-mcp-server | 2026-09-04 | 7.5 High |
| firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like credentials and environment variables, which are then uploaded and returned to the model context. | ||||
| CVE-2026-85396 | 2 Rubyzip, Rubyzip Project | 2 Rubyzip, Rubyzip | 2026-09-04 | 7.5 High |
| rubyzip versions before 3.4.0 contain a path traversal vulnerability in Zip::Entry#extract that fails to properly validate extraction paths using prefix comparison without trailing separators. Attackers can craft archive entries with names like ../upload_backup/owned.sh to write files outside the intended extraction directory into sibling paths sharing the destination prefix. | ||||
| CVE-2026-82521 | 1 Domainaware | 1 Parsedmarc | 2026-09-04 | 5.3 Medium |
| parsedmarc 9.0.6 before 11.0.1 writes forensic report sample files using an output path derived from the email subject. When the subject consists entirely of path traversal sequences, the filename sanitization function produces an empty string, and a fallback to the raw unsanitized subject causes the resulting file to be written outside the intended samples directory. An attacker who can cause a forensic failure report with a crafted Subject to be processed can write a dot-prefixed file with attacker-controlled content to an ancestor directory of the configured samples output path. Exploitation requires that file output for forensic report samples is enabled. | ||||
| CVE-2026-85456 | 1 Moos-ivp | 1 Moos-ivp | 2026-09-04 | 5.5 Medium |
| MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory. Attackers can supply crafted alog files with backslash sequences in variable names to escape the output directory and append to arbitrary files on Windows systems. | ||||
| CVE-2026-85580 | 2 B3log, Siyuan | 2 Siyuan, Siyuan | 2026-09-04 | 6.5 Medium |
| SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive publish-access configuration and metadata. | ||||
| CVE-2026-56718 | 1 Ajcloud | 1 Ajy Ipc Firmware | 2026-09-04 | 7.5 High |
| AJCloud AJY IPC firmware prior to version 01.10715.11.37 contains a path traversal vulnerability in the jdbhttpd web service that allows unauthenticated remote attackers to read arbitrary files with root privileges by supplying path traversal sequences in the HTTP request URI. Attackers can send crafted HTTP requests to port 80 without authentication to access sensitive files including cleartext RTSP credentials, Wi-Fi SSID and pre-shared key, device serial number, and cloud binding parameters. | ||||
| CVE-2026-73760 | 2 Hewlett Packard Enterprise (hpe), Hpe | 157 Aos-cx, Aruba Cx 10000-48y6c \(r8p13a\), Aruba Cx 10000-48y6c \(r8p14a\) and 154 more | 2026-09-04 | 6.5 Medium |
| An authenticated Path Traversal vulnerability exists in AOS-CX. Successful exploitation of this vulnerability allows an attacker to read arbitrary files from the web-based management interface of the underlying operating system, which could lead to remote unauthorized access to files. | ||||
| CVE-2026-73752 | 2 Hewlett Packard Enterprise (hpe), Hpe | 157 Aos-cx, Aruba Cx 10000-48y6c \(r8p13a\), Aruba Cx 10000-48y6c \(r8p14a\) and 154 more | 2026-09-04 | 8.8 High |
| An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability allows an attacker to write arbitrary files to the underlying operating system, which could lead to remote code execution. | ||||