Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,018 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-29509 |
medium | 5.3 | 0.0037 | 2026-06-26 | Patool before 4.0.5 contains a path traversal vulnerability in the safe_extract() function in patool | |
CVE-2026-57079 |
medium | 5.3 | 0.0040 | 2026-06-30 | Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path t | |
CVE-2026-28705 |
medium | 5.3 | 0.0045 | 2026-07-03 | Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components whe | |
CVE-2026-14636 |
medium | 5.3 | 0.0038 | 2026-07-04 | A weakness has been identified in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to 23105f25dadf57b4 | |
CVE-2026-58203 |
medium | 5.3 | 0.0019 | 2026-07-06 | pydantic-settings provides settings management using Pydantic. From 2.12.0 until 2.14.2, NestedSecre | |
CVE-2026-15331 |
medium | 5.3 | 0.0044 | 2026-07-10 | A vulnerability was identified in zhayujie CowAgent up to 2.1.0. The affected element is the functio | |
CVE-2026-11944 |
medium | 5.3 | 0.0048 | 2026-07-14 | openSIS Classic 9.3 contains an authenticated path traversal vulnerability in the legacy messaging s | |
CVE-2026-48049 |
medium | 5.3 | 0.0059 | 2026-07-17 | @hapi/inert provides static file and directory handlers for hapi.js. From 4.0.0 to 7.1.0, @hapi/iner | |
CVE-2026-57716 |
medium | 5.3 | 0.0037 | 2026-07-23 | Unauthenticated Arbitrary File Deletion in Broadcast Live Video <= 7.2.4 versions. | |
CVE-2026-65920 |
medium | 5.3 | 0.0040 | 2026-07-23 | Diffusers through 0.39.0, fixed in commit cee298c, contains a path traversal vulnerability in the _g | |
CVE-2026-61632 |
medium | 5.3 | 0.0040 | 2026-08-06 | PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. In versions up t | |
CVE-2026-73244 |
medium | 5.3 | 0.0044 | 2026-08-11 | kkFileView is a universal file online preview project based on Spring Boot. Prior to 5.0.1, the unau | |
CVE-2026-63134 |
medium | 5.3 | 0.0042 | 2026-08-11 | Malcolm is a network traffic analysis tool suite. Prior to version 26.07.0, `safe-extract.py` protec | |
CVE-2026-66381 |
medium | 5.3 | 0.0039 | 2026-08-12 | A repository reader with cache-deploy permission may access content outside a configured upstream pa | |
CVE-2026-66384 |
medium | 5.3 | 0.0066 | 2026-08-12 | KEV | JFrog Artifactory contains an improper limitation of a pathname to a restricted directory vulnerabil |
CVE-2026-113664 |
medium | 5.3 | 0.0049 | 2026-10-20 | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.0 of the import-expo | |
CVE-2026-80067 |
medium | 5.3 | — | 2026-10-29 | MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allo | |
CVE-2026-80069 |
medium | 5.3 | — | 2026-10-29 | MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability th | |
CVE-2026-90871 |
medium | 5.3 | — | 2026-10-29 | Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versi | |
CVE-2026-114377 |
medium | 5.1 | 0.0040 | 2026-10-21 | A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this | |
CVE-2026-42213 |
medium | 5.1 | 0.0056 | 2026-05-08 | SolidCAM-GPPL-IDE is an unofficial, independently developed extension, Postprocessor IDE for SolidCA | |
CVE-2026-53906 |
medium | 5.1 | 0.0052 | 2026-07-01 | MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to da | |
CVE-2026-53457 |
medium | 5.1 | 0.0076 | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5. | |
CVE-2026-40256 |
medium | 5.0 | 0.0032 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, repository-boundary validation | |
CVE-2026-59152 |
medium | 5.0 | 0.0020 | 2026-07-06 | LangSmith Client SDKs provide SDK's for interacting with the LangSmith platform. Prior to 0.8.18, an | |
CVE-2026-104743 |
medium | 4.9 | 0.0084 | 2026-10-28 | The Tainacan plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and in | |
CVE-2026-20174 |
medium | 4.9 | 0.0050 | 2026-04-01 | A vulnerability in the Metadata update feature of Cisco Nexus Dashboard Insights could allow an auth | |
CVE-2026-20148 |
medium | 4.9 | 0.0654 | 2026-04-15 | A vulnerability in Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to perf | |
CVE-2026-25525 |
medium | 4.9 | 0.0050 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative t | |
CVE-2026-4917 |
medium | 4.9 | 0.0036 | 2026-04-23 | IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the | |
CVE-2026-41887 |
medium | 4.9 | 0.0047 | 2026-05-08 | Flarum is open-source forum software. Prior to versions 1.8.16 and 2.0.0-rc.1, Flarum's patch for CV | |
CVE-2026-53594 |
medium | 4.9 | 0.0042 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. FreeScout's `Mana | |
CVE-2026-66476 |
medium | 4.9 | 0.0050 | 2026-07-27 | Administrator Arbitrary File Deletion in Easy Digital Downloads <= 3.6.9 versions. | |
CVE-2026-71283 |
medium | 4.9 | 0.0043 | 2026-08-05 | Fledge's backup-restore upload handler, upload_backup (python/fledge/services/core/api/backup_restor | |
CVE-2026-72773 |
medium | 4.9 | 0.0057 | 2026-08-11 | n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-us | |
CVE-2026-73383 |
medium | 4.9 | 0.0047 | 2026-08-18 | Shop manager Arbitrary File Download in CTX Feed <= 6.6.47 versions. | |
CVE-2025-69904 |
medium | 4.9 | 0.0047 | 2026-09-11 | Linkstack v4.8.4 and earlier is vulnerable to Path Traversal, which allows an administrator to read | |
CVE-2026-106494 |
medium | 4.9 | 0.0031 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backe | |
CVE-2026-24147 |
medium | 4.8 | 0.0048 | 2026-04-07 | NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause | |
CVE-2026-47091 |
medium | 4.8 | 0.0013 | 2026-05-18 | Claude HUD through 0.0.12, patched in commit 234d9aa, contains a path traversal vulnerability that a | |
CVE-2026-56377 |
medium | 4.8 | 0.0016 | 2026-06-30 | ImageMagick before 7.1.2-24 contains an incorrect policy check that allows attackers to create or tr | |
CVE-2026-19046 |
medium | 4.8 | 0.0020 | 2026-08-06 | A security vulnerability has been detected in NocteDefensor LudusMCP up to 1.0.24. The impacted elem | |
CVE-2026-19336 |
medium | 4.8 | 0.0020 | 2026-08-09 | A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function | |
CVE-2026-19368 |
medium | 4.8 | 0.0017 | 2026-08-09 | A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown func | |
CVE-2026-115800 |
medium | 4.8 | 0.0014 | 2026-10-23 | A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the f | |
CVE-2026-116046 |
medium | 4.8 | 0.0014 | 2026-10-25 | A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getC | |
CVE-2026-35613 |
medium | 4.7 | 0.0014 | 2026-04-07 | coursevault-preview is a utility for previewing course material files from a configured directory. c | |
CVE-2026-42078 |
medium | 4.6 | 0.0020 | 2026-05-04 | PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, PPTA | |
CVE-2026-42080 |
medium | 4.6 | 0.0020 | 2026-05-04 | PPTAgent is an agentic framework for reflective PowerPoint generation. Prior to commit 418491a, ther | |
CVE-2026-41530 |
medium | 4.6 | 0.0015 | 2026-05-12 | The automatic folder creation feature of Lhaz and Lhaz+ provided by Chitora soft contains a path tra |