CVE-2026-31927

Anviz CX7 Firmware Relative Path Traversal

Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files (e.g., /etc/shadow), enabling unauthorized SSH access when combined with debug‑setting changes.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx7 Firmware Cx7 Cx7 Firmware

CVE-2026-55474

Snipe-IT: Directory traversal in displaySig

Snipe-IT is an IT asset/license management system. Prior to 8.5.0, ActionlogController::displaySig concatenates the route filename parameter into a private upload-directory path without sanitization, allowing an authenticated attacker to traverse outside the intended directory and read arbitrary files accessible to the web server process. This issue is fixed in version 8.5.0.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Grokability Snipeitapp

Products

Snipe-it Snipe-it

CVE-2026-59996

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-59832

SiYuan: Authenticated path traversal in /snippets/ static handler (serveSnippets) leaks conf/conf.json secrets and siyuan.db

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /snippets/*filepath route handler serveSnippets in kernel/server/serve.go joins a single-decoded request path with the snippets directory without subpath containment or sensitive-path checks, allowing an authenticated request such as /snippets/%2e%2e/%2e%2e/conf/conf.json to read workspace secrets and the document database. This issue is fixed in versions 3.7.1.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Siyuan

Products

Siyuan

CVE-2026-57032

Junos OS: EX Series: Subscribing to an unsupported telemetry sensor path causes fxpc process crash

An Improper Handling of Undefined Parameters vulnerability in the packet forwarding engine (pfe) of Juniper Networks Junos OS on EX Series devices allows an authenticated attacker with low privileges to cause a Denial-of-Service (DoS). If an attempt is made to subscribe to an unsupported telemetry sensor path on EX2300, EX3400, EX4000, EX4100 and EX4400 via gRPC, this causes the FPC to crash. This leads to a complete service outage until the module has automatically restarted.  The following log message can be seen when this issue happens: agentd[<PID>]: AGENTD_RESOURCE_NOT_FOUND: No resource name found for <sensor> This issue affects Junos OS on EX2300, EX3400, EX4000, EX4100 and EX4400 devices: * all versions before 23.2R2-S7, * 23.4 versions before 23.4R2-S8, * 24.2 versions before 24.2R2-S5, * 24.4 versions before 24.4R2.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Juniper Juniper Networks

Products

Ex2300 Ex2300-c Ex3400 and 8 more

CVE-2026-59149

Mockoon: Path traversal in templated `filePath` lets a request escape the served directory (prefix-only base check)

Mockoon provides way to design and run mock APIs. Prior to 9.7.0, a FILE response whose filePath embeds request data is confined by getSafeFilePath in packages/commons-server/src/libs/server/server.ts with resolvedPath.startsWith(staticBaseDir). That prefix test has no path-separator boundary, so a ../-escaped path whose absolute form string-prefixes the base directory passes, allowing an unauthenticated client to read files from sibling paths outside the served directory through HTTP sendFile, WebSocket, or callbacks. This issue is fixed in version 9.7.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mockoon

Products

Mockoon

CVE-2026-15168

Use of Uninitialized Variable in Wireshark

BLF file parser in Wireshark 4.6.0 to 4.6.6 and 4.4.0 to 4.4.16 allows possible information disclosure

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

Wireshark

Products

Wireshark

CVE-2026-8650

Authenticated Path Traversal allows MOVEit admins to view arbitrary system files

Relative path traversal vulnerability in Progress MOVEit Transfer (Admin Settings module). This issue affects MOVEit Transfer: before 2025.0.7, from 2025.1.0 before 2025.1.3.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Moveit Transfer

CVE-2026-59995

openssh: OpenSSH: sftp client allows attacker to control downloaded file location

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed

Vendors

Openbsd

Products

Openssh

CVE-2026-44941

libzypp path traversal via "keyhint" in repomd.xml

A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.

CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Opensuse Suse

Products

Libzypp Libzypp

CVE-2026-8387

Relative Path Traversal in allegroai/clearml

A vulnerability in allegroai/clearml versions up to and including 1.16.5 allows for relative path traversal when extracting `.zip` archives using the `ZipFile.extractall()` method in `StorageManager._extract_to_cache()`. This issue arises due to the lack of path traversal validation, enabling an attacker to write arbitrary files to the filesystem. Attack vectors include dataset downloads, artifact downloads, model downloads, and offline session imports. The vulnerability can lead to remote code execution through methods such as cron job injection, SSH key overwrite, or web shell deployment. The issue is resolved in version 2.1.6.

CVSS 3.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Allegroai

Products

Clearml

CVE-2025-53829

ownCloud 10 is vulnerable to Relative Path Traversal

ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can exploit a path traversal vulnerability in the system to execute arbitrary code. Upgrade ownCloud 10 to version 10.15.3 or later to receive a patch.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Owncloud

Products

Owncloud

CVE-2026-57988

Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

Relative path traversal in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Edge Chromium

CVE-2026-58522

Microsoft Edge for Android Information Disclosure Vulnerability

Relative path traversal in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Google Microsoft

Products

Android Edge Chromium

CVE-2026-25707

Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp

A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Opensuse Suse

Products

Libzypp Libzypp

CVE-2026-50016

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Pnpm

Products

Pnpm

CVE-2026-45188

Apache Kvrocks: Replication Fullsync Path Traversal via Unvalidated Filename Handling

Relative Path Traversal vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.15.0. Users are recommended to upgrade to version 2.16.0, which fixes the issue.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Kvrocks

CVE-2026-54066

SiYuan: Path Traversal via Double URL Encoding in /assets/*path (publish mode arbitrary file─read)

SiYuan is an open-source personal knowledge management system. Prior to 3.7.0, the patch for CVE-2026-41894 ("Path Traversal via Double URL Encoding") sanitized the /export/ route but the identical root cause remains in the /assets/*path route. In publish mode (anonymous read-only HTTP endpoint, default port 6808), an unauthenticated remote attacker can read arbitrary files inside WorkspaceDir — including conf/conf.json (which contains the AccessAuthCode SHA256 hash, API token, and sync keys), temp/siyuan.db, temp/blocktree.db, and siyuan.log — by double-URL-encoding .. segments. This vulnerability is fixed in 3.7.0.

CVSS 3.1 · 7.5 High EPSS 2.2% KEV · Not listed

Vendors

Siyuan

Products

Siyuan

CVE-2026-52813

Gogs: Path Traversal in organization name results in RCE through Git hooks

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.

CVSS 3.1 · 10 Critical EPSS 1.1% KEV · Not listed

Vendors

Gogs

Products

Gogs

CVE-2026-10720

MicroCeph path traversal issue in the remote-import API

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate (such as enrolled cluster members) or join token can manipulate files in an imported remote cluster within the /var/snap/microceph confinement. This would allow daemon disruption and pollution of the cluster state.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Canonical

Products

Microceph