Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,025 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-20916 |
high | 7.2 | 0.0037 | 2026-05-13 | An authenticated iControl REST user with low privileges can create or modify arbitrary files through | |
CVE-2026-11846 |
high | 7.2 | 0.0040 | 2026-06-12 | The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File D | |
CVE-2026-9777 |
high | 7.2 | 0.0223 | 2026-06-24 | ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability. This vulnerability al | |
CVE-2026-9778 |
high | 7.2 | 0.0223 | 2026-06-24 | ATEN Unizon ImportDeviceList Directory Traversal Remote Code Execution Vulnerability. This vulnerabi | |
CVE-2026-49506 |
high | 7.2 | 0.0087 | 2026-06-25 | Dell Wyse Management Suite, versions prior to WMS 5.5 HF1, contain an Improper Limitation of a Pathn | |
CVE-2026-45233 |
high | 7.2 | 0.0090 | 2026-06-25 | HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authentic | |
CVE-2026-58170 |
high | 7.2 | 0.0055 | 2026-06-30 | Vibe-Trading before 0.1.10 builds the proposal file path by joining a caller-supplied proposal ident | |
CVE-2026-11917 |
high | 7.2 | 0.0044 | 2026-07-14 | A path traversal security issue exists within Rockwell Automation ThinManager® software due to impro | |
CVE-2026-63454 |
high | 7.2 | 0.0087 | 2026-07-21 | An authenticated path traversal vulnerability exists in AOS-CX. Successful exploitation of this vuln | |
CVE-2026-73030 |
high | 7.2 | 0.0059 | 2026-08-10 | unearth through 0.18.2, fixed in commit 6c78164, contains a path traversal vulnerability in the is_w | |
CVE-2026-73620 |
high | 7.2 | 0.0057 | 2026-08-13 | GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReferenc | |
CVE-2026-114622 |
high | 7.2 | 0.0049 | 2026-10-23 | baserCMS is a website development framework. In versions 5.2.3 before 5.3.2 and 5.4.0 before 5.4.2, | |
CVE-2026-49253 |
high | 7.1 | 0.0044 | 2026-08-19 | electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3 | |
CVE-2026-115354 |
high | 7.1 | 0.0047 | 2026-10-22 | Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that al | |
CVE-2026-93864 |
high | 7.1 | 0.0013 | 2026-10-27 | A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker w | |
CVE-2026-118038 |
high | 7.1 | 0.0025 | 2026-10-28 | In Progress® Telerik® Document Processing Libraries prior to version 2026.3.1027, a path traversal v | |
CVE-2025-39664 |
high | 7.1 | 0.0071 | 2025-10-09 | Insufficient escaping in the report scheduler within Checkmk <2.4.0p13, <2.3.0p38, <2.2.0p46 and 2.1 | |
CVE-2025-63365 |
high | 7.1 | 0.0030 | 2025-12-01 | SoftSea EPUB File Reader 1.0.0.0 is vulnerable to Directory Traversal. The vulnerability resides in | |
CVE-2026-28265 |
high | 7.1 | 0.0012 | 2026-04-01 | PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker w | |
CVE-2026-34790 |
high | 7.1 | 0.0063 | 2026-04-02 | Endian Firewall version 3.3.25 and prior allow authenticated users to delete arbitrary files via dir | |
CVE-2026-39308 |
high | 7.1 | 0.0033 | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry publish endpo | |
CVE-2026-39977 |
high | 7.1 | 0.0029 | 2026-04-09 | flatpak-builder is a tool to build flatpaks from source. From 1.4.5 to before 1.4.8, the license-fil | |
CVE-2026-40503 |
high | 7.1 | 0.0041 | 2026-04-16 | OpenHarness prior to commit dd1d235 contains a path traversal vulnerability that allows remote gatew | |
CVE-2026-40518 |
high | 7.1 | 0.0036 | 2026-04-17 | ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerab | |
CVE-2026-39973 |
high | 7.1 | 0.0018 | 2026-04-21 | Apktool is a tool for reverse engineering Android APK files. In versions 3.0.0 and 3.0.1, a path tra | |
CVE-2026-6855 |
high | 7.1 | 0.0016 | 2026-04-22 | A flaw was found in InstructLab. A local attacker could exploit a path traversal vulnerability in th | |
CVE-2026-34414 |
high | 7.1 | 0.0283 | 2026-04-22 | Xerte Online Toolkits versions 3.15 and earlier contain a relative path traversal vulnerability in t | |
CVE-2026-6968 |
high | 7.1 | 0.0053 | 2026-04-24 | Incomplete path traversal fixes in awslabs/tough before tough-v0.22.0 allow remote authenticated use | |
CVE-2026-6865 |
high | 7.1 | 0.0030 | 2026-05-12 | CWE-22: Improper Limitation of a Pathname to a Restricted Directory (“Path Traversal”) vulnerability | |
CVE-2026-44647 |
high | 7.1 | 0.0032 | 2026-05-14 | OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that bre | |
CVE-2026-44641 |
high | 7.1 | 0.0043 | 2026-05-15 | Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, | |
CVE-2026-47118 |
high | 7.1 | 0.0037 | 2026-05-27 | Agent Zero before version 1.15 contains a path traversal vulnerability that allows unauthenticated a | |
CVE-2026-3840 |
high | 7.1 | 0.0019 | 2026-06-12 | A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a c | |
CVE-2026-8811 |
high | 7.1 | 0.0032 | 2026-06-18 | SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF | |
CVE-2026-49339 |
high | 7.1 | 0.0031 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. The maintainer | |
CVE-2026-56394 |
high | 7.1 | 0.0049 | 2026-06-21 | Craft CMS from 4.0.0-RC1 contains an authenticated path traversal vulnerability in the assets/icon e | |
CVE-2026-57321 |
high | 7.1 | 0.0041 | 2026-06-26 | Contributor Arbitrary File Deletion in H5P <= 1.17.7 versions. | |
CVE-2026-57346 |
high | 7.1 | 0.0041 | 2026-06-29 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Epip | |
CVE-2026-58451 |
high | 7.1 | 0.0056 | 2026-07-01 | Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authen | |
CVE-2026-59510 |
high | 7.1 | 0.0051 | 2026-07-05 | AIL Framework contains a path traversal vulnerability in its PDF object handling. Prior to commit 14 | |
CVE-2026-59867 |
high | 7.1 | 0.0239 | 2026-07-16 | Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, Kiota resolved Ope | |
CVE-2026-46336 |
high | 7.1 | 0.0039 | 2026-07-16 | Manyfold is an open source, self-hosted web application for managing a collection of 3d models, part | |
CVE-2026-50163 |
high | 7.1 | 0.0040 | 2026-07-17 | oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, ensureLinkPath in content/file/u | |
CVE-2026-46555 |
high | 7.1 | 0.0021 | 2026-07-20 | WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read a | |
CVE-2026-58484 |
high | 7.1 | 0.0020 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.12.2, `EnvironmentMa | |
CVE-2026-56623 |
high | 7.1 | 0.0087 | 2026-07-20 | Path traversal on Windows in Apache MINA SSHD component sshd-git. Apache MINA SSHD is a Java library | |
CVE-2026-47397 |
high | 7.1 | 0.0046 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, hidden metadata in a webpage cause | |
CVE-2026-57696 |
high | 7.1 | 0.0041 | 2026-07-23 | Contributor Arbitrary File Deletion in Picture Gallery <= 1.6.5 versions. | |
CVE-2026-65607 |
high | 7.1 | 0.0059 | 2026-07-23 | SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit bran | |
CVE-2026-54545 |
high | 7.1 | 0.0020 | 2026-07-28 | wakaru is a JavaScript decompiler and unminifier toolkit. From 1.0.0 until 1.4.0, @wakaru/cli saniti |