Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,025 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-72783 |
medium | 6.9 | 0.0020 | 2026-08-11 | Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical p | |
CVE-2026-67613 |
medium | 6.9 | 0.0050 | 2026-08-13 | CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administra | |
CVE-2026-64967 |
medium | 6.9 | 0.0049 | 2026-08-20 | A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative p | |
CVE-2026-76611 |
medium | 6.9 | 0.0050 | 2026-08-21 | Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery elemen | |
CVE-2026-93347 |
medium | 6.9 | 0.0042 | 2026-10-13 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper t | |
CVE-2026-111618 |
medium | 6.9 | 0.0043 | 2026-10-16 | CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the genera | |
CVE-2026-11319 |
medium | 6.9 | 0.0017 | 2026-10-19 | TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in | |
CVE-2026-116073 |
medium | 6.9 | 0.0032 | 2026-10-25 | Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that | |
CVE-2026-116168 |
medium | 6.9 | 0.0019 | 2026-10-25 | SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAs | |
CVE-2026-116117 |
medium | 6.9 | 0.0050 | 2026-10-26 | A flaw has been found in halo-dev halo up to 2.27.0-beta.1. Affected by this vulnerability is the fu | |
CVE-2026-116255 |
medium | 6.9 | 0.0068 | 2026-10-26 | A vulnerability has been found in PGYER codefever up to 0c35e60f006f9d558cc33a159baf110659351990. Af | |
CVE-2026-113692 |
medium | 6.9 | — | 2026-10-29 | Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25 | |
CVE-2026-86383 |
medium | 6.8 | 0.0046 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2025 release version | |
CVE-2026-102229 |
medium | 6.8 | 0.0106 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code | |
CVE-2026-33220 |
medium | 6.8 | 0.0032 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the translation memory API expo | |
CVE-2026-45224 |
medium | 6.8 | 0.0014 | 2026-05-11 | Crabbox before 0.9.0 contains a path traversal vulnerability in the Islo provider's workspace path r | |
CVE-2026-43901 |
medium | 6.8 | 0.0034 | 2026-05-11 | Wireshark MCP is an MCP Server that turns tshark into a structured analysis interface, then layers i | |
CVE-2026-39468 |
medium | 6.8 | 0.0122 | 2026-06-15 | Contributor Arbitrary File Deletion in Meta Box – WordPress Custom Fields Framework <= 5.11.1 versio | |
CVE-2026-61431 |
medium | 6.8 | 0.0037 | 2026-07-10 | PraisonAI before 4.6.78 contains a path traversal vulnerability in ContextGatherer that fails to val | |
CVE-2026-60088 |
medium | 6.8 | 0.0022 | 2026-07-11 | PraisonAI before 4.6.78 fails to validate file path references in custom command templates, allowing | |
CVE-2026-48338 |
medium | 6.8 | 0.0047 | 2026-07-14 | ColdFusion is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Trav | |
CVE-2026-55747 |
medium | 6.8 | 0.0035 | 2026-08-05 | The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a helper as a thin | |
CVE-2026-33922 |
medium | 6.8 | 0.0017 | 2026-08-11 | A path traversal vulnerability was discovered in the Offline archives functionality of the local web | |
CVE-2026-71475 |
medium | 6.8 | 0.0069 | 2026-08-11 | A flaw was found in insights-client. A compromised managed cluster, referred to as a 'spoke', can in | |
CVE-2026-65939 |
medium | 6.8 | 0.0038 | 2026-08-12 | In WhatsUp Gold versions released before 2026.0.2, a privileged attacker can create a LogToFile acti | |
CVE-2026-75104 |
medium | 6.8 | 0.0029 | 2026-08-17 | Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing atta | |
CVE-2026-63328 |
medium | 6.8 | 0.0019 | 2026-08-18 | Trivy is a security scanner. Prior to 0.72.0, plugin manifest metadata is used by pkg/plugin/manager | |
CVE-2026-61625 |
medium | 6.8 | 0.0040 | 2026-08-20 | VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122. | |
CVE-2026-118756 |
medium | 6.7 | 0.0014 | 2026-10-28 | gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that | |
CVE-2026-25691 |
medium | 6.7 | 0.0046 | 2026-04-14 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fo | |
CVE-2026-42866 |
medium | 6.7 | 0.0021 | 2026-05-11 | Tookie is a advanced OSINT information gathering tool. Prior to 4.1fix, modules/modules.py's write_t | |
CVE-2026-109574 |
medium | 6.7 | 0.0014 | 2026-10-12 | Hugo before v0.167.0 contains a path traversal vulnerability in css.Sass that allows malicious theme | |
CVE-2026-112049 |
medium | 6.7 | 0.0015 | 2026-10-18 | Vita3K before build 4187 contains a path traversal (zip slip) vulnerability in install_archive_conte | |
CVE-2026-44192 |
medium | 6.6 | 0.0020 | 2026-07-22 | A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, | |
CVE-2026-70593 |
medium | 6.6 | 0.0041 | 2026-08-04 | Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a vulnerability in custom th | |
CVE-2024-42718 |
medium | 6.5 | 0.0065 | 2025-12-26 | A path traversal vulnerability in Croogo CMS 4.0.7 allows remote attackers to read arbitrary files v | |
CVE-2026-105457 |
medium | 6.5 | 0.0042 | 2026-10-28 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVE | |
CVE-2026-85932 |
medium | 6.5 | 0.0118 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S | |
CVE-2026-69973 |
medium | 6.5 | 0.0078 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Windows Libarchive | |
CVE-2026-70298 |
medium | 6.5 | 0.0123 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S | |
CVE-2023-28163 |
medium | 6.5 | 0.0080 | 2023-06-02 | When downloading files through the Save As dialog on Windows with suggested filenames containing env | |
CVE-2025-54748 |
medium | 6.5 | 0.0039 | 2025-12-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Roma | |
CVE-2026-33989 |
medium | 6.5 | 0.0050 | 2026-03-27 | Mobile Next is an MCP server for mobile development and automation. Prior to version 0.0.49, the `@m | |
CVE-2026-34750 |
medium | 6.5 | 0.0036 | 2026-04-01 | Payload is a free and open source headless content management system. Prior to version 3.78.0 in @pa | |
CVE-2026-35492 |
medium | 6.5 | 0.0043 | 2026-04-07 | Kedro-Datasets is a Kendo plugin providing data connectors. Prior to 9.3.0, PartitionedDataset in ke | |
CVE-2026-22573 |
medium | 6.5 | 0.0042 | 2026-04-14 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in F | |
CVE-2026-39377 |
medium | 6.5 | 0.0027 | 2026-04-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja | |
CVE-2026-39378 |
medium | 6.5 | 0.0031 | 2026-04-21 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja | |
CVE-2026-40909 |
medium | 6.5 | 0.0066 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint ( | |
CVE-2026-41062 |
medium | 6.5 | 0.0072 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the directory traversal fi |