Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
8,982 results · page 2 of 180
Oct 22, 2026Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the naCVE-2022-51025 · Other software · Penta Security Systems · reported by VulnCheckHigh 7.1
Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /webapi/file/transfer. Attackers can send GET requests with type=db_backup and ../ sequences in name to read files like /etc/passwd, and a hardcoded systemi account makes authentication effectively trivial. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- WAPPLES
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences iCVE-2022-51024 · Other software · Kareadita · reported by VulnCheckHigh 8.7
Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename parameter. Attackers can send GET requests to /api/image/cover-upload with filename values like ../appsettings.json to retrieve configuration files outside the temp directory. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- Product
- Kavita
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that alloCVE-2022-51022 · Other software · liukuo362573 · reported by VulnCheckHigh 8.8
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
- Product
- YiShaAdmin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme opeCVE-2021-48017 · Other software · OrbiTeam · reported by VulnCheckHigh 8.7
OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parameter of the theme operation. Attackers can send GET requests to /pub/bscw.cgi/<id>?op=theme with ../ sequences in style_name to read local files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
- Product
- BSCW Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstorm.news
Oct 22, 2026JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameCVE-2021-48015 · Other software · erzhongxmu · reported by VulnCheckHigh 8.7
JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows remote attackers to read arbitrary files via the dbPath parameter. Attackers can send GET requests to /systemController/showOrDownByurl.do with ../ sequences in dbPath, which bypasses AuthInterceptor, to retrieve files like win.ini. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-17.
- Product
- JeeWMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write aCVE-2021-48014 · Other software · FanRuan · reported by VulnCheckCritical 9.3
FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- FineReport
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weCVE-2021-48013 · Other software · Weaver Network Co., Ltd. · reported by VulnCheckHigh 8.7
Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath parameter of the /weaver/ln.FileDownload endpoint. Attackers can send crafted GET requests with directory traversal sequences in fpath to retrieve sensitive files such as WEB-INF/web.xml from the server. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- Product
- E-cology
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 22, 2026MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via tCVE-2018-25439 · Other software · MetInfo · reported by VulnCheckHigh 8.7
MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read arbitrary files via the dir parameter. Attackers can send crafted requests with backslash sequences bypassing the str_replace filter to read files like config_db.php on Windows. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
- Product
- MetInfo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comweb.archive.org
Oct 22, 2026Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrarCVE-2018-25438 · Other software · Intermesh · reported by VulnCheckHigh 8.7
Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attackers to read arbitrary files by manipulating the 'file' parameter. Attackers can send GET requests to /compress.php with '../' sequences in the 'file' parameter, which is appended to the cache path and passed to readfile(), to read files such as /etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-21.
- Product
- Group-Office
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcxsecurity.comgithub.com
Oct 22, 2026Javo Spot: Path traversalCVE-2017-20287 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the fn parameter of the jvfrm_spot_get_json AJAX action. Attackers can send GET requests to /wp-admin/admin-ajax.php with fn set to ../../wp-config.php to retrieve database credentials and secret keys. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Javo Spot
- Fixed in
- 3.0.0
- What to do
- Update Javo Spot to 3.0.0 or newer.
Full record and what to do →NVD recordcodeseekah.comgithub.com
Oct 22, 2026ACF Extended: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-112311 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF Extended acf-extended allows Path Traversal.This issue affects ACF Extended: from n/a through 0.9.2.7.
- Product
- ACF Extended
- Affected
- up to 0.9.2.7
- What to do
- Affects up to 0.9.2.7. Update ACF Extended to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM).CVE-2026-96375 · Websites & servers · reported by mlhess@drupal.orgMedium 4.8
Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM). This issue affects Cloud versions: from 0.0.0 to 7.0.1.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM).CVE-2026-87944 · Websites & servers · reported by mlhess@drupal.orgMedium 4.8
Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle (AiTM). This issue affects SAML SSO - Service Provider versions: from 0.0.0 to 3.2.0.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal.CVE-2026-81163 · Websites & servers · reported by mlhess@drupal.orgMedium 5.4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Drupal Media Library Importer allows Path Traversal. This issue affects Media Library Importer versions: from 0.0.0 to 2.1.6.
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin.CVE-2026-114714 · Websites & servers · Roundcube · reported by MITREMedium 5.3
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
- Product
- Webmail
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.debian.orggithub.com
Oct 21, 2026A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices.CVE-2026-89052 · Network & remote access · TP-Link Systems Inc. · reported by f23511db-6c3e-4e32-a477-6aa17d310630Medium 5.9
A hardcoded cryptographic key management vulnerability exists in Archer C6 due to the use of a universal cryptographic key shared across devices. An attacker who obtains an encrypted configuration file or other protected credential data can recover plaintext credentials. Successful exploitation may allow unauthorized disclosure of sensitive information, including administrative credentials.
- Product
- Archer C6 V2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtp-link.comtp-link.com
Oct 21, 2026BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability.CVE-2026-92205 · Other software · BusyBox · reported by zdi-disclosures@trendmicro.comMedium 6.1
BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the libarchive component. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to create files in the context of the current user. Was ZDI-CAN-27556.
- Product
- BusyBox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by suppCVE-2026-114492 · Other software · flipped-aurora · reported by VulnCheckHigh 7
gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../' sequences, causing os.RemoveAll to delete any directory writable by the server process.
- Product
- gin-vue-admin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026weForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2026-111833 · WordPress plugins & themes · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traversal.This issue affects weForms: from n/a through 1.6.28.
- Product
- weForms
- Affected
- up to 1.6.28
- What to do
- Affects up to 1.6.28. Update weForms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 21, 2026Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to oveCVE-2026-114402 · Other software · polonel · reported by VulnCheckMedium 5.3
Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authenticated users to overwrite other users' avatars via form-supplied _id and username fields. Attackers can supply a username like /../../../x to bypass the incomplete CVE-2022-1752 sanitization and write png, jpg, jpeg, or gif files outside public/uploads/users.
- Product
- trudesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to CVE-2026-114399 · Other software · polonel · reported by VulnCheckHigh 7
Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /api/v1/backup/restore to restore archives from, or extract to, paths outside the intended directories.
- Product
- trudesk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 21, 2026NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbounCVE-2026-96405 · Other software · NLnet Labs · reported by sep@nlnetlabs.nlMedium 5.3
NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.
- Product
- Unbound
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal pathCVE-2026-114110 · Other software · astral-sh · reported by VulnCheckHigh 8.7
Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by supplying wheels with relative traversal paths in RECORD entries. Attackers can craft a malicious wheel whose RECORD references files outside the installation prefix, causing uv to delete those files when the user uninstalls the package.
- Product
- uv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts CVE-2026-114109 · Other software · astral-sh · reported by VulnCheckHigh 8.7
uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the scripts directory via crafted console_scripts or gui_scripts entry point names. Attackers who induce users to install a malicious wheel can place executables in PATH directories, shadowing or overwriting existing binaries for code execution.
- Product
- uv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agentCVE-2026-114106 · Other software · HKUDS · reported by VulnCheckHigh 8.7
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read sensitive server files through LLM agent file-read tools. Attackers can prompt the agent to invoke read_document, which lacks sandbox checks, or safe_user_path-gated tools to leak /etc/shadow, /proc/self/environ API keys, and /root credentials.
- Product
- Vibe-Trading
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree tCVE-2026-114098 · Other software · jelmer · reported by VulnCheckHigh 7.3
Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to write arbitrary files outside the worktree through intermediate directory symlinks. Attackers can craft a malicious repository whose popped stash writes a payload into .git/hooks/post-checkout, achieving code execution on the next checkout.
- Product
- dulwich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the CVE-2026-114097 · Other software · jelmer · reported by VulnCheckHigh 7.3
Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that allows attackers to write files outside the working directory via symlinks persisting between commits. Attackers can craft a repository where an ancestor commit's symlink redirects a descendant commit's file writes during filter_branch, enabling code execution by writing into .git/hooks.
- Product
- dulwich
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to esCVE-2026-114083 · Other software · triggerdotdev · reported by VulnCheckHigh 8.6
Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets endpoints that allows authenticated tenants to escape their object key prefix through an unsanitized filename splat segment. Attackers holding one valid API key can supply ../ sequences to obtain presigned GET or PUT URLs and read or overwrite other tenants' run payloads and outputs.
- Product
- trigger.dev
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attCVE-2026-114063 · Other software · sveltejs · reported by VulnCheckHigh 8.7
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
- Product
- kit
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinCVE-2025-71437 · Other software · astral-sh · reported by VulnCheckHigh 8.7
Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that allows a specially crafted sequence of symlinks to redirect file writes outside the intended extraction prefix. Attackers can publish a malicious sdist that, when installed by a victim, writes arbitrary files to filesystem locations outside the installation prefix.
- Product
- uv
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 20, 2026EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary filCVE-2016-20104 · Other software · EyeLock · reported by VulnCheckHigh 8.7
EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- nano NXT
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.compacketstorm.news
Oct 20, 2026Cherry: Path traversalCVE-2016-20103 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the 'file' parameter. Attackers can send GET requests to /admin/import-export/download-content.php with traversal sequences like ../../../../../wp-config.php to read database credentials, since the script passes input directly to readfile(). Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Cherry
- Fixed in
- 1.2.7
- What to do
- Update Cherry to 1.2.7 or newer.
Oct 20, 2026Memphis Documents Library: Path traversalCVE-2016-20100 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the mdocs-img-preview parameter. Attackers can send GET requests with traversal sequences to mdocs_img_preview() in mdocs-downloads.php to download wp-config.php containing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-22.
- Product
- Memphis Documents Library
- Fixed in
- 3.1.6
- What to do
- Update Memphis Documents Library to 3.1.6 or newer.
Full record and what to do →NVD recordgithub.compacketstorm.news
Oct 20, 2026Aspose PDF Exporter: Path traversalCVE-2015-20125 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download files through the unsanitized 'file' parameter passed to readfile(). Attackers can send GET requests to aspose_pdf_exporter_download.php with traversal sequences like ../../../wp-config.php to retrieve WordPress database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- Aspose PDF Exporter
- Fixed in
- 2.0
- What to do
- Update Aspose PDF Exporter to 2.0 or newer.
Full record and what to do →NVD recordgithub.compacketstorm.news
Oct 20, 2026Aspose Importer & Exporter: Path traversalCVE-2015-20124 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files via the unsanitized 'file' parameter. Attackers can send GET requests to aspose_import_export_download.php with traversal sequences like ../../../wp-config.php to read database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
- Product
- Aspose Importer & Exporter
- Fixed in
- 3.0
- What to do
- Update Aspose Importer & Exporter to 3.0 or newer.
Full record and what to do →NVD recordgithub.compacketstorm.news
Oct 20, 2026Aspose Doc Exporter: Path traversalCVE-2015-20123 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files by passing unsanitized paths to readfile(). Attackers can send GET requests to aspose_doc_exporter_download.php with the 'file' parameter set to values like ../../../wp-config.php to retrieve database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-23.
- Product
- Aspose Doc Exporter
- Fixed in
- 2.0
- What to do
- Update Aspose Doc Exporter to 2.0 or newer.
Full record and what to do →NVD recordgithub.compacketstorm.news
Oct 20, 2026ChurcHope: Path traversalCVE-2014-125134 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the 'file' parameter of /wp-content/themes/churchope/lib/downloadlink.php. Attackers can supply directory traversal sequences to read sensitive files like wp-config.php or /etc/passwd, exposing database credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.
- Product
- ChurcHope
- Fixed in
- 2.2
- What to do
- Update ChurcHope to 2.2 or newer.
Full record and what to do →NVD recordgithub.compacketstorm.news
Oct 20, 2026NativeChurch: Path traversalCVE-2014-125133 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbitrary files through the file parameter of download.php. Attackers can send GET requests with directory traversal sequences in the file parameter to retrieve sensitive files like wp-config.php. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- NativeChurch
- Fixed in
- 1.6.2
- What to do
- Update NativeChurch to 1.6.2 or newer.
Full record and what to do →NVD recordgithub.comimithemes.com
Oct 20, 2026TinyMCE Thumbnail Gallery: Path traversalCVE-2012-20002 · WordPress plugins & themes · reported by VulnCheckHigh 8.7
TinyMCE Thumbnail Gallery plugin for WordPress before 1.1.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the href parameter. Attackers can send GET requests to /php/download-image.php with traversal sequences like ../../../../wp-config.php to retrieve database credentials and system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.
- Product
- TinyMCE Thumbnail Gallery
- Fixed in
- 1.1.0
- What to do
- Update TinyMCE Thumbnail Gallery to 1.1.0 or newer.
Full record and what to do →NVD recordgithub.compacketstorm.news
Oct 20, 2026Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to reCVE-2026-105772 · Computers, phones & browsers · Google · reported by cve-coordination@google.comCritical 9.1
Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenticated attacker to read files matching the artifact directory layout or write files (when an agent tool invokes saveArtifact) outside the intended artifact storage root via crafted relative or percent-encoded path traversal sequences (such as ../ or ..%2F) in the userId or sessionId parameters when the ADK API server is exposed with the non-default FileArtifactService enabled. Applications using the default InMemoryArtifactService are unaffected. Upgrade to @google/adk version 0.6.0 or later.
- Product
- ADK TypeScript (@google/adk)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for thCVE-2026-93475 · Other software · Eclipse Foundation · reported by emo@eclipse.orgCritical 9.3
The X.509 parser in NetX Secure accepts an RSA public key of any size, but every signature-verification path decrypts into fixed-size buffers dimensioned for the `NX_CRYPTO_MAX_RSA_MODULUS_SIZE` default of 4096 bits. A certificate carrying a larger modulus drives an out-of-bounds write past a file-scope static during ordinary certificate-chain verification. It is reachable pre-authentication. The issuer used for the crypto operation is looked up in the remote, peer-supplied store before the trusted store, so the attacker supplies the oversized key themselves as an intermediate in the chain they present. It triggers on a TLS or DTLS client verifying a malicious server's chain, and on a server performing client-certificate authentication.
- Product
- Eclipse ThreadX - NetX Duo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying maliciCVE-2026-113613 · Other software · FlexGet · reported by VulnCheckCritical 9.2
FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to write arbitrary files by supplying malicious archive member paths. Attackers can deliver zip or rar archives with ../ sequences or absolute paths through a feed, writing Python files into the plugins directory for code execution.
- Product
- FlexGet
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims wiCVE-2026-113352 · Other software · uTox · reported by VulnCheckHigh 7.7
uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ft_find_resumeable() loads, abusing FILE pointers to write /proc/self/mem and execute code.
- Product
- uTox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 20, 2026A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.CVE-2026-43851 · Other software · Advantech · reported by 5f57b9bf-260d-4433-bf07-b6a79e9bb7d4High 8.2
A path traversal vulnerability could allow an authenticated attacker to read arbitrary files on the system.
- Product
- ADAM-3600
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordadvantech.comcsa.gov.sg
Oct 19, 2026MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem CVE-2026-53995 · Other software · mlflow · reported by VulnCheckHigh 8.8
MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit FileStore.start_trace() to write trace_info.yaml, request_metadata, and tag files with attacker-controlled metadata outside the intended experiment trace directory, subject to the server process's filesystem permissions. FileStore is the default tracking backend before MLflow 3.7.0 and opt-in thereafter (the default changed to a SQLite database), so deployments in the earlier part of the affected range are vulnerable without special configuration while later ones are affected only when FileStore is explicitly selected.
- Product
- mlflow
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious loCVE-2026-11319 · Other software · TickTick Limited · reported by VulnCheckMedium 6.9
TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename via ACTION_SEND intents. A malicious application can register a ContentProvider returning a _display_name value containing traversal sequences, which is passed unsanitized through FileManager.getDisplayNameFromUri and AttachmentFileHelper.copyFileDirectly, causing automatic file writes to attacker-chosen locations with TickTick's application privileges.
- Product
- TickTick for Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Oct 19, 2026The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain CVE-2025-7203 · Other software · WSO2 · reported by ed10eef1-636d-4fbe-9993-6890dfa878f8Medium 4.9
The Management Console and product files expose sensitive data, including remote log server credentials, truststore passwords, and keystore passwords, in plain text. This occurs because the system does not sufficiently protect or obscure these credentials when the remote logging feature is enabled. An attacker with administrative access to the Management Console or direct access to product files can retrieve these sensitive credentials. This allows for potential manipulation of log entries and compromise of the integrity and confidentiality of the remote log server.
- Product
- WSO2 Universal Gateway
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.docs.wso2.com
Oct 19, 2026Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibrarCVE-2026-111925 · Other software · Mopidy · reported by VulnCheckMedium 6.9
Mopidy before 4.0.5 contains a path traversal vulnerability that allows unauthenticated clients to access local files outside file/media_dirs because FileLibraryProvider.lookup() lacks a containment check. Attackers can call core.library.lookup or core.tracklist.add over JSON-RPC or WebSocket with file:// URIs to probe file existence, read tag metadata, and play out-of-sandbox files.
- Product
- Mopidy
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parametCVE-2026-111915 · Other software · purocean · reported by VulnCheckHigh 8.2
Yank Note before 3.93.1 contains a path traversal vulnerability that allows unauthenticated remote attackers to read arbitrary files via the path or doc parameter of /api/help. Attackers can supply repeated '../' segments, which bypass the single-replacement sanitization in the publicly allowlisted endpoint, to read SSH keys, configuration, or notes.
- Product
- Yank Note
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 19, 2026Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.CVE-2026-79986 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.4
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolute remote path of each file by concatenating the configured directory with the file name reported in the server's directory listing. That concatenation (FtpUtils.absoluteFilePath and GenericFileConsumer) applied no lexical normalization and no check that the result stayed inside the directory being polled, and the resulting path became the operand for every subsequent remote operation on the file: retrieval (FtpOperations.retrieveFile / SftpOperations, reached from GenericFileConsumer where the retrieve name is taken verbatim from GenericFile.getAbsoluteFilePath), deletion when delete=true (GenericFileDeleteProcessStrategy), and renaming when move, preMove, moveFailed or readLock=rename is configured (GenericFileProcessStrategySupport and GenericFileRenameExclusiveReadLockStrategy). Neither isValidFile nor isMatched performed any containment check. A listing entry that is not
- Product
- Apache Camel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcamel.apache.orggithub.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.