Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,018 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-66484 |
medium | 4.6 | 0.0020 | 2026-08-10 | GNU cpio contains a Path Traversal vulnerability in its tar archive extraction functionality. When e | |
CVE-2026-113719 |
medium | 4.5 | 0.0020 | 2026-10-20 | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInstall | |
CVE-2026-42549 |
medium | 4.4 | 0.0020 | 2026-05-13 | Flight is an extensible micro-framework for PHP. Prior to 3.18.1, the make:controller CLI command ca | |
CVE-2026-39489 |
medium | 4.4 | 0.0034 | 2026-06-15 | Author Arbitrary File Download in Download Monitor <= 5.1.9 versions. | |
CVE-2026-41124 |
medium | 4.4 | 0.0017 | 2026-07-03 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2026 release version 8.6.1.0 through | |
CVE-2026-46671 |
medium | 4.4 | 0.0015 | 2026-07-20 | Rust OneNote File Parser is a parser for Microsoft OneNote files implemented in Rust. Prior to versi | |
CVE-2026-118667 |
medium | 4.3 | 0.0039 | 2026-10-28 | LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads | |
CVE-2026-33227 |
medium | 4.3 | 0.0042 | 2026-04-07 | Improper validation and restriction of a classpath path name vulnerability in Apache ActiveMQ Cli | |
CVE-2026-33929 |
medium | 4.3 | 0.0071 | 2026-04-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-42885 |
medium | 4.3 | 0.0028 | 2026-05-11 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.32.2, the POST /api/filesys | |
CVE-2026-41009 |
medium | 4.3 | 0.0010 | 2026-05-27 | When the director sends a long-running request (e.g. compile_package), the agent's reply JSON is con | |
CVE-2026-10601 |
medium | 4.3 | 0.0029 | 2026-06-22 | A user with Viewer permissions can use specially crafted requests to the Tempo and Loki data source | |
CVE-2026-48789 |
medium | 4.3 | 0.0034 | 2026-06-24 | AnythingLLM is an application that turns pieces of content into context that any LLM can use as refe | |
CVE-2026-8662 |
medium | 4.3 | 0.0029 | 2026-06-25 | Path Traversal vulnerability in the create_archive function of Rapid7 InsightConnect Compression Plu | |
CVE-2026-46338 |
medium | 4.3 | 0.0040 | 2026-07-16 | PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 unti | |
CVE-2026-15160 |
medium | 4.3 | 0.0066 | 2026-07-17 | The Ninja Forms - Excel Export plugin for WordPress is vulnerable to Directory Traversal in all vers | |
CVE-2026-66382 |
medium | 4.3 | 0.0035 | 2026-08-12 | An authenticated user may write files outside the intended Artifactory work directory under specific | |
CVE-2026-18106 |
medium | 4.3 | 0.0050 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive informa | |
CVE-2026-53584 |
medium | 4.3 | 0.0033 | 2026-08-20 | libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a | |
CVE-2026-107745 |
medium | 4.2 | 0.0032 | 2026-10-28 | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to | |
CVE-2026-54319 |
medium | 4.2 | 0.0024 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent wor | |
CVE-2026-41861 |
medium | 4.2 | 0.0021 | 2026-08-06 | Path Traversal in BOSH-Ecosystem / BOSH allows an IaaS-metadata attacker to make the agent write a r | |
CVE-2026-106493 |
medium | 4.1 | 0.0028 | 2026-10-06 | Backstage is an open framework for building developer portals. Prior to 1.54.6, cloud storage catalo | |
CVE-2025-65713 |
medium | 4.0 | 0.0040 | 2025-12-23 | Home Assistant Core before v2025.8.0 is vulnerable to Directory Traversal. The Downloader integratio | |
CVE-2026-16888 |
low | 3.7 | 0.0050 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to obtain sensitive info | |
CVE-2026-114370 |
low | 3.7 | 0.0032 | 2026-10-21 | A flaw was found in the PathResourceManager component of the Undertow web server. This component is | |
CVE-2026-104312 |
low | 3.5 | — | 2026-10-29 | IBM Langflow OSS 1.0.0 through 1.12.3 could allow an authenticated attacker to produce a server-gene | |
CVE-2026-113731 |
low | 3.3 | 0.0019 | 2026-10-20 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered pe | |
CVE-2026-116673 |
low | 3.3 | 0.0013 | 2026-10-27 | systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux ne | |
CVE-2023-27409 |
low | 3.3 | 0.0017 | 2023-05-09 | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). A path traversal vuln | |
CVE-2026-29051 |
low | 3.3 | 0.0017 | 2026-04-24 | melange allows users to build apk packages using declarative pipelines. Starting in version 0.32.0 a | |
CVE-2026-115569 |
low | 3.3 | 0.0019 | 2026-10-23 | Fallow is a codebase intelligence tool for TypeScript and JavaScript. From 2.68.0 until 3.34.0, Fall | |
CVE-2026-14967 |
low | 3.1 | 0.0026 | 2026-07-08 | BBOT's `github_workflows` module could be induced to write a downloaded artifact outside its configu | |
CVE-2023-29128 |
low | 2.7 | 0.0068 | 2023-05-09 | A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), | |
CVE-2026-53480 |
low | 2.7 | 0.0035 | 2026-07-08 | Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through | |
CVE-2026-12660 |
low | 2.7 | 0.0024 | 2026-10-19 | IBM MQ Web Console could allow an authenticated administrator to write files outside the intended di | |
CVE-2026-15687 |
low | 2.4 | 0.0038 | 2026-07-23 | A security issue was discovered in the Kubernetes Java client library where a compromised pod may be | |
CVE-2026-64963 |
low | 2.3 | 0.0053 | 2026-08-20 | A path traversal vulnerability in ATutor allows an authenticated user to access files from other cou | |
CVE-2026-58171 |
low | 2.3 | 0.0034 | 2026-06-30 | Vibe-Trading before 0.1.10 constructs the swarm run directory by joining a caller-supplied run ident | |
CVE-2026-93571 |
low | 2.3 | — | 2026-10-29 | Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who ca | |
CVE-2026-113743 |
low | 2.1 | 0.0044 | 2026-10-21 | A weakness has been identified in Tenstorrent tt-metal up to 0.80.0. The affected element is the fun | |
CVE-2026-117510 |
low | 2.1 | 0.0049 | 2026-10-27 | A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function | |
CVE-2026-6487 |
low | 2.1 | 0.0037 | 2026-04-17 | A flaw has been found in Qihui jtbc5 CMS 5.0.3.6. Affected is an unknown function of the file /dev/c | |
CVE-2026-6496 |
low | 2.1 | 0.0046 | 2026-04-17 | A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function | |
CVE-2026-6620 |
low | 2.1 | 0.0035 | 2026-04-20 | A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0. The affected element is the fun | |
CVE-2026-6636 |
low | 2.1 | 0.0047 | 2026-04-20 | A vulnerability was detected in p2r3 convert up to 6998584ace3e11db66dff0b423612a5cf91de75b. Affecte | |
CVE-2026-7024 |
low | 2.1 | 0.0037 | 2026-04-26 | A flaw has been found in rawchen sims up to 004f783b1db5ecdfad81c8fdc3b34171211112de. Affected by th | |
CVE-2026-7086 |
low | 2.1 | 0.0041 | 2026-04-27 | A vulnerability was identified in HBAI-Ltd Toonflow-app up to 1.1.1. This issue affects the function | |
CVE-2026-7445 |
low | 2.1 | 0.0029 | 2026-04-30 | A security vulnerability has been detected in ZachHandley ZMCPTools up to 0.2.2. Affected by this is | |
CVE-2026-7599 |
low | 2.1 | 0.0029 | 2026-05-01 | A vulnerability was detected in Dayoooun hwpx-mcp 0.2.0. This affects the function save_document/exp |