Base de CVEs

An improper validation of user-supplied input leads to a local file inclusion vulnerability.

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. This vulnerability is similar in scope to CVE-2025-71210 but affects a different executable. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

A vulnerability in the Trend Micro Apex One management console could allow a remote attacker to upload malicious code and execute commands on affected installations. Please note: although this vulnerability carries a technical critical CVSS rating, this was reported via responsible disclosure via a researcher through the Zero Day Initiative. The SaaS versions of the product have already been mitigated and no customer action required. For this particular vulnerability, an attacker must have access to the Trend Micro Apex One Management Console, so customers that have their console�s IP address exposed externally should consider mitigating factors such as source restrictions if not already applied.

Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4.x <= 11.4.4, 10.11.x <= 10.11.14 fail to check integration URL for path traversal which allows an malicious authenticated user to call an arbitrary API via system admin Mattermost auth token using via path traversal in integration action URL.. Mattermost Advisory ID: MMSA-2026-00640

Existe uma vulnerabilidade de travessia de diretório no StorageController do Altium Enterprise Server Viewer devido ao tratamento inadequado de parâmetros de rota de caminhos de arquivo. Em implantações locais que usam armazenamento em sistema de arquivos local, um usuário autenticado comum pode fornecer um caminho absoluto codificado em URL (como uma letra de unidade codificada) em uma requisição à API de armazenamento do Viewer, fazendo com que a raiz de armazenamento configurada seja descartada e permitindo a leitura de arquivos arbitrários do sistema de arquivos do servidor. Como os arquivos legíveis incluem a configuração mestre do servidor, que armazena credenciais de banco de dados, localizações de chaves de assinatura, senhas de certificados e segredos OAuth, a exploração pode levar à divulgação de todos os segredos do servidor e ao comprometimento total do servidor e de seus dados. Implantações em nuvem não são afetadas, pois usam armazenamento de objetos e não habilitam este componente.