CVE Database

CVE-2026-44415 Critical · 9.1 CWE-35 Oct 13, 2026

Affected systems do not properly restrict access to internal APIs and paths for authenticated...

Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system or result in the deletion of data.

CVE-2026-44414 Medium · 6.8 CWE-35 Oct 13, 2026

A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge...

A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge Device Kit - arm64 V1.14, Industrial Edge Device Kit - arm64 V1.15, Industrial Edge Device Kit - arm64 V1.16, Industrial Edge Device Kit - arm64 V1.17, Industrial Edge Device Kit - arm64 V1.18, Industrial Edge Device Kit - arm64 V1.19, Industrial Edge Device Kit - arm64 V1.20, Industrial Edge Device Kit - arm64 V1.21, Industrial Edge Device Kit - arm64 V1.22, Industrial Edge Device Kit - arm64 V1.23, Industrial Edge Device Kit - arm64 V1.24, Industrial Edge Device Kit - arm64 V1.25, Industrial Edge Device Kit - arm64 V1.26, Industrial Edge Device Kit - arm64 V1.27, Industrial Edge Device Kit - arm64 V1.28, Industrial Edge Device Kit - arm64 V1.5, Industrial Edge Device Kit - arm64 V1.6, Industrial Edge Device Kit - arm64 V1.7, Industrial Edge Device Kit - arm64 V1.8, Industrial Edge Device Kit - arm64 V1.9, Industrial Edge Device Kit - x86-64 V1.10, Industrial Edge Device Kit - x86-64 V1.11, Industrial Edge Device Kit - x86-64 V1.12, Industrial Edge Device Kit - x86-64 V1.13, Industrial Edge Device Kit - x86-64 V1.14, Industrial Edge Device Kit - x86-64 V1.15, Industrial Edge Device Kit - x86-64 V1.16, Industrial Edge Device Kit - x86-64 V1.17, Industrial Edge Device Kit - x86-64 V1.18, Industrial Edge Device Kit - x86-64 V1.19, Industrial Edge Device Kit - x86-64 V1.20, Industrial Edge Device Kit - x86-64 V1.21, Industrial Edge Device Kit - x86-64 V1.22, Industrial Edge Device Kit - x86-64 V1.23, Industrial Edge Device Kit - x86-64 V1.24, Industrial Edge Device Kit - x86-64 V1.25, Industrial Edge Device Kit - x86-64 V1.26, Industrial Edge Device Kit - x86-64 V1.27, Industrial Edge Device Kit - x86-64 V1.28, Industrial Edge Device Kit - x86-64 V1.5, Industrial Edge Device Kit - x86-64 V1.6, Industrial Edge Device Kit - x86-64 V1.7, Industrial Edge Device Kit - x86-64 V1.8, Industrial Edge Device Kit - x86-64 V1.9, Industrial Edge Own Device (IEOD), Industrial Edge Virtual Device (IEVD), SCALANCE LPE9413 (6GK5998-3GS01-2AC2), SCALANCE LPE9433 (6GK5998-3GS11-2AC2), SIMATIC IoT2050 Advanced IED (6ES7647-0BW00-1YA2), SIMATIC IoT2050 SM IED (6ES7647-0CW00-1AA2), SIMATIC IPC BX-21A Industrial Edge Device, SIMATIC IPC BX-39A Industrial Edge Device, SIMATIC IPC BX-59A Industrial Edge Device, SIMATIC IPC127E Industrial Edge Device, SIMATIC IPC227E Industrial Edge Device, SIMATIC IPC227G Industrial Edge Device, SIMATIC IPC427E Industrial Edge Device, SIMATIC IPC847E Industrial Edge Device. Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthorized access to the system.

CVE-2026-5703 High · 7.1 CWE-35 Oct 7, 2026

Path Traversal in Satel Iberia SenNet Datalogger Serie 200

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information.

CVE-2026-105683 Low · 3.8 CWE-35 Oct 5, 2026

Ghost: Path Traversal Vulnerability in Ghost ImageSize Service

Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.

CVE-2026-103290 Low · 3.8 CWE-35 Oct 1, 2026

Ghost 6.14.0 before 6.27.0 Path Traversal via ImageSize

Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended data storage directories on the server.

CVE-2026-82824 Critical · 9.8 CWE-35 Oct 1, 2026

Path traversal may allow arbitrary files to be viewed, created, modified, or deleted

Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0.

CVE-2026-97244 High · 7.5 CWE-35 Sep 30, 2026

WordPress Creator LMS plugin <= 1.2.19 - Path Traversal vulnerability

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

CVE-2026-27557 High · 7.5 CWE-35 Sep 16, 2026

Path Traversal in /index.php/view_uploaded_iodd_file

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.

CVE-2026-85310 Medium · 6.5 CWE-35 Sep 10, 2026

WordPress Groundhogg plugin <= 4.7.1 - Path Traversal vulnerability

import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.

CVE-2026-21103 Medium · 6.1 CWE-35 Sep 9, 2026

Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical…

Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege.

CVE-2026-21092 Medium · 5.3 CWE-35 Sep 9, 2026

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to…

Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.

CVE-2026-20513 Medium · 4.4 CWE-35 Sep 6, 2026

In Audio HAL, there is a possible information disclosure due to improper input…

In Audio HAL, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11087533; Issue ID: MSV-8245.

CVE-2026-59909 High · 7.1 CWE-35 Aug 17, 2026

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

CVE-2026-56089 Low · 3.3 CWE-35 Aug 17, 2026

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability…

Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure.

CVE-2026-28157 High · 7.5 CWE-35 Aug 13, 2026

WordPress Do Lasso plugin <= 358 - Path Traversal vulnerability

Subscriber Path Traversal in Do Lasso <= 358 versions.

CVE-2026-69109 High · 7.5 CWE-35 Aug 11, 2026

A vulnerability has been identified in Siemens License Server (SLS) (All versions <…

A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application.

CVE-2026-13716 Critical · 9.1 CWE-35 Aug 11, 2026

Path Traversal: '.../...//' in Crafty Controller

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

CVE-2026-59115 Critical · 9.9 CWE-35 Aug 6, 2026

Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.

CVE-2026-66695 Medium · 6.5 CWE-35 Aug 6, 2026

WordPress W3 Total Cache plugin <= 2.10.2 - Path Traversal vulnerability

Unauthenticated Path Traversal in W3 Total Cache <= 2.10.2 versions.

CVE-2025-59181 Medium · 4.8 CWE-35 Jul 27, 2026

Path traversal Vulnerability

Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a directory traversal vulnerability in Configuration Management that could allow an attacker to change directory permissions, denying access to legitimate users.

CVE-2025-60835 High · 7.8 CWE-35 Jul 22, 2026

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path…

An issue in the unrar.dll component of IZArc v4.6 allows attackers to execute a path traversal.

CVE-2026-49779 Medium · 6.5 CWE-35 Jul 2, 2026

WordPress Tax Exempt for WooCommerce plugin < 1.9.5 - Path Traversal vulnerability

Path Traversal: '.../...//' vulnerability in Addify Tax Exempt for WooCommerce allows Path Traversal. This issue affects Tax Exempt for WooCommerce: from n/a before 1.9.5.

CVE-2026-52707 High · 8.1 CWE-35 Jun 17, 2026

WordPress Kastell theme <= 2.0 - Local File Inclusion vulnerability

Unauthenticated Local File Inclusion in Kastell <= 2.0 versions.

CVE-2026-52703 Critical · 9.6 CWE-35 Jun 15, 2026

WordPress FastDup plugin <= 2.7.2 - Path Traversal vulnerability

Unauthenticated Path Traversal in FastDup <= 2.7.2 versions.

CVE-2026-49112 High · 7.5 CWE-35 Jun 15, 2026

WordPress Shared Files plugin <= 1.7.64 - Path Traversal vulnerability

Unauthenticated Path Traversal in Shared Files <= 1.7.64 versions.