Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 673

Export CSV
CVE-2026-5966

TeamT5｜ThreatSonar Anti-Ransomware - Arbitrary File Deletion

ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability. Authenticated remote attackers with web access can exploit Path Traversal to delete arbitrary files on the system.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Teamt5
Products
Threatsonar Anti-ransomware
CVE-2025-55752

Apache Tomcat: Directory traversal via rewrite with possible RCE if PUT is enabled

Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the possibility that, for rewrite rules that rewrite query parameters to the URL, an attacker could manipulate the request URI to bypass security constraints including the protection for /WEB-INF/ and /META-INF/. If PUT requests were also enabled then malicious files could be uploaded leading to remote code execution. PUT requests are normally limited to trusted users and it is considered unlikely that PUT requests would be enabled in conjunction with a rewrite that manipulated the URI. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.10, from 10.1.0-M1 through 10.1.44, from 9.0.0.M11 through 9.0.108. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.6 though 8.5.100. Other, older, EOL versions may also be affected. Users are recommended to upgrade to version 11.0.11 or later, 10.1.45 or later or 9.0.109 or later, which fix the issue.

CVSS 3.1 · 7.5 High EPSS 64.4% KEV · Not listed
Vendors
Apache
Products
Tomcat
CVE-2026-41551

Path Traversal Allowing Remote File Read in Siemens ROS#

A vulnerability has been identified in ROS# (All versions < V2.2.2). Affected versions contain a path traversal vulnerability because user input is not properly sanitized. This could allow a remote attacker to access arbitrary files on the device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Siemens
Products
Ros
CVE-2026-8209

Path Traversal Exploit Causes Denial of Service in Gibbon

Gibbon versions before v30.0.01 are affected by a path traversal vulnerability resulting in DOS by attempting extraction of web application PHP files, failed .zip extraction results in deletion of the file and a DOS condition. Successful exploitation requires Teacher or higher privileges. Exploitation could result in loss of availability of the web application.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gibbonedu
Products
Gibbon
CVE-2026-42085

OpenC3 COSMOS: Arbitrary write to plugins directory via path-traversed config filenames

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. Prior to versions 6.10.5 and 7.0.0-rc3, OpenC3 COSMOS contains a design flaw in the save_tool_config() function that allows saving tool configuration files at arbitrary locations inside the shared /plugins directory tree by supplying crafted configuration filenames. Although the implementation sufficiently mitigates standard path traversal attacks, by canonicalizing filename to an absolute path, all plugins share this same root directory. That enables users to create arbitrary file structures and overwrite existing configuration files within the shared /plugins directory. This issue has been patched in versions 6.10.5 and 7.0.0-rc3.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Openc3
Products
Cosmos
CVE-2026-43533

OpenClaw < 2026.4.10 - Arbitrary Local File Read via QQBot Media Tags

OpenClaw before 2026.4.10 contains an arbitrary file read vulnerability in QQBot media tags that allows attackers to reference host-local paths outside the intended media storage boundary. Attackers can craft malicious reply text containing media tags to disclose arbitrary local files through outbound media handling.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-22070

ColorOS Assistant Path Traversal Vulnerability

ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Oppo
Products
Coloros Assistant
CVE-2026-6870

Access of Uninitialized Pointer in Wireshark

GSM RP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2026-6529

Heap-based Buffer Overflow in Wireshark

iLBC audio codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2026-6869

Improperly Controlled Sequential Memory Allocation in Wireshark

WebSocket protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2026-5654

Stack-based Buffer Overflow in Wireshark

AMR-NB codec crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2026-5655

Use After Free in Wireshark

SDP protocol dissector crash in Wireshark 4.6.0 to 4.6.4 allows denial of service

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wireshark
Products
Wireshark
CVE-2026-7404

getsimpletool mcpo-simple-server base_manager.py delete_shared_prompt path traversal

A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0. Affected is the function delete_shared_prompt of the file src/mcpo_simple_server/services/prompt_manager/base_manager.py. This manipulation of the argument detail causes relative path traversal. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Getsimpletool
Products
Mcpo-simple-server
CVE-2024-49253

WordPress Analyse Uploads plugin <= 0.5 - Arbitrary File Deletion vulnerability

Relative Path Traversal vulnerability in JamesPark.ninja Analyse Uploads analyse-uploads allows Relative Path Traversal.This issue affects Analyse Uploads: from n/a through <= 0.5.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
James Park
Products
Analyse Uploads
CVE-2026-20078

Cisco Unity Connection Arbitrary File Download Vulnerability

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker&nbsp;to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials.&nbsp; These vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Unity Connection
CVE-2026-20081

Cisco Unity Connection Arbitrary File Download Vulnerability

Multiple vulnerabilities in Cisco Unity Connection could allow an authenticated, remote attacker&nbsp;to download arbitrary files from an affected system. To exploit these vulnerabilities, the attacker must have valid administrative credentials.&nbsp; These vulnerabilities are due to improper sanitization of user input to the web-based management interface. An attacker could exploit these vulnerabilities by sending a crafted HTTPS request. A successful exploit could allow the attacker to download arbitrary files from an affected system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Unity Connection
CVE-2026-30345

CTFd Zip Slip Vulnerability in Admin Import Enables Arbitrary File Write

A zip slip vulnerability in the Admin import functionality of CTFd v3.8.1-18-gdb5a18c4 allows attackers to write arbitrary files outside the intended directories via supplying a crafted import.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Ctfd
Products
Ctfd
CVE-2026-33733

EspoCRM has Admin TemplateManager path traversal that allows arbitrary file read write and delete

EspoCRM is an open source customer relationship management application. Prior to version 9.3.4, the admin template management endpoints accept attacker-controlled `name` and `scope` values and pass them into template path construction without normalization or traversal filtering. As a result, an authenticated admin can use `../` sequences to escape the intended template directory and read, create, overwrite, or delete arbitrary files that resolve to `body.tpl` or `subject.tpl` under the web application user's filesystem permissions. Version 9.3.4 fixes the issue.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2025-47445

WordPress Eventin plugin <= 4.0.26 - Arbitrary File Download Vulnerability

Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.

CVSS 3.1 · 7.5 High EPSS 5.2% KEV · Not listed
Vendors
Themewinter
Products
Eventin
CVE-2025-32137

WordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability

Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—