Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,001 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-44542 |
critical | 9.1 | 0.0052 | 2026-05-14 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.3.1-stable and 1.3.9- | |
CVE-2026-53519 |
critical | 9.1 | 0.0193 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Prio | |
CVE-2026-50203 |
critical | 9.1 | 0.0063 | 2026-06-17 | A path traversal in the SFTP provider (`SFTPHook.retrieve_directory` / `SFTPOperator(operation=get)` | |
CVE-2026-40005 |
critical | 9.1 | 0.0054 | 2026-07-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-53486 |
critical | 9.1 | 0.0075 | 2026-07-14 | The decompress package for Node.js extracts archives. Prior to 10.2.1 and 11.1.3, archive extraction | |
CVE-2026-47731 |
critical | 9.1 | 0.0089 | 2026-07-21 | The AMMOS Instrument Toolkit (Formerly the Bespoke Links to Instruments for Surface and Space (BLISS | |
CVE-2026-72569 |
critical | 9.1 | 0.0074 | 2026-08-10 | A path traversal vulnerability in cube-root/directory-serve through 1.3.7 allows an unauthenticated | |
CVE-2026-48024 |
critical | 9.1 | 0.0078 | 2026-08-19 | Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4 | |
CVE-2026-9827 |
critical | 9.1 | 0.0063 | 2026-10-20 | A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (versi | |
CVE-2026-64825 |
critical | 9.0 | 0.0058 | 2026-07-21 | Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthentica | |
CVE-2026-58072 |
critical | 9.0 | 0.0053 | 2026-08-04 | A vulnerability in Veeam Service Provider Console allowing arbitrary file write on the management se | |
CVE-2026-47897 |
high | 8.9 | 0.0072 | 2026-07-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-47896 |
high | 8.9 | 0.0081 | 2026-07-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-44829 |
high | 8.8 | 0.0050 | 2026-08-19 | Gotenberg is a Docker-powered stateless API for PDF files. In 8.32.0 and earlier, filename handling | |
CVE-2026-96275 |
high | 8.8 | 0.0049 | 2026-09-23 | A malicious or compromised Flatpak repository can write attacker-controlled content to arbitrary loc | |
CVE-2026-86398 |
high | 8.8 | 0.0034 | 2026-10-28 | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release version | |
CVE-2026-103407 |
high | 8.8 | — | 2026-10-28 | An Improper Limitation of a Pathname to a Restricted Directory vulnerability in ConfigDirector in Ju | |
CVE-2026-118619 |
high | 8.8 | — | 2026-10-28 | Ultralytics Google Drive Download Path Traversal Remote Code Execution Vulnerability. This vulnerabi | |
CVE-2026-49163 |
high | 8.8 | 0.0102 | 2026-08-06 | Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insigh | |
CVE-2026-65768 |
high | 8.8 | 0.0094 | 2026-08-11 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams fo | |
CVE-2026-102226 |
high | 8.8 | 0.0104 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business | |
CVE-2026-105727 |
high | 8.8 | 0.0104 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business | |
CVE-2026-108452 |
high | 8.8 | 0.0082 | 2026-10-15 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S | |
CVE-2026-69943 |
high | 8.8 | 0.0116 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office S | |
CVE-2026-85634 |
high | 8.8 | 0.0041 | 2026-10-15 | A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core libra | |
CVE-2023-27534 |
high | 8.8 | 0.0244 | 2023-03-30 | A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) charac | |
CVE-2026-35050 |
high | 8.8 | 0.0044 | 2026-04-06 | text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4. | |
CVE-2026-39981 |
high | 8.8 | 0.0132 | 2026-04-09 | AGiXT is a dynamic AI Agent Automation Platform. Prior to 1.9.2, the safe_join() function in the ess | |
CVE-2026-42608 |
high | 8.8 | 0.0060 | 2026-05-11 | Grav is a file-based Web platform. Prior to 2.0.0-beta.2, there is a Path Traversal vulnerability wi | |
CVE-2026-7474 |
high | 8.8 | 0.0816 | 2026-05-12 | HashiCorp Nomad and Nomad Enterprise prior to 2.0.1 are vulnerable to code execution on the client h | |
CVE-2026-45230 |
high | 8.8 | 0.0063 | 2026-05-18 | DumbAssets through 1.0.11 contains a path traversal vulnerability in the POST /api/delete-file endpo | |
CVE-2026-57296 |
high | 8.8 | 0.0083 | 2026-06-24 | Jenkins External Workspace Manager Plugin 1.3.2 and earlier does not reject path traversal sequences | |
CVE-2026-56445 |
high | 8.8 | 0.0064 | 2026-06-25 | The qrscp application's C-STORE handler uses a specific instance from attacker-supplied DICOM datase | |
CVE-2026-58166 |
high | 8.8 | 0.0085 | 2026-06-30 | OpenBMB ChatDev through 2.2.0, fixed in commit 4fd4da6, contains a path traversal vulnerability that | |
CVE-2026-52868 |
high | 8.8 | 0.0049 | 2026-06-30 | An unauthenticated attacker can read worklist records from a directory outside the intended per-AE w | |
CVE-2026-42200 |
high | 8.8 | 0.0066 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. | |
CVE-2026-53951 |
high | 8.8 | 0.0026 | 2026-07-08 | Copier is a library and CLI app for rendering project templates. In versions 9.5.0 through 9.15.1, t | |
CVE-2026-43637 |
high | 8.8 | 0.0066 | 2026-07-15 | Cornac before 2.6.0 contains a path traversal (Tar Slip) vulnerability that allows attackers to writ | |
CVE-2026-44177 |
high | 8.8 | 0.0177 | 2026-07-16 | Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, K | |
CVE-2026-7667 |
high | 8.8 | 0.0056 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to create a malicious flow po | |
CVE-2026-47871 |
high | 8.8 | 0.0096 | 2026-07-18 | VMware Avi Load Balancer contains a directory traversal vulnerability. Flaws in file path validation | |
CVE-2026-65702 |
high | 8.8 | 0.0058 | 2026-07-23 | Vanna through 2.0.2 contains a path traversal vulnerability in the FileSystemConversationStore persi | |
CVE-2026-65921 |
high | 8.8 | 0.0059 | 2026-07-27 | A path validation weakness in archive extraction/write handling allows entries with traversal sequen | |
CVE-2026-60009 |
high | 8.8 | 0.0044 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend binds `POST /f | |
CVE-2026-17556 |
high | 8.8 | 0.0080 | 2026-08-05 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenti | |
CVE-2026-13105 |
high | 8.8 | 0.0050 | 2026-08-12 | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 is vulnerable to zip slip path traversal expl | |
CVE-2026-13622 |
high | 8.8 | 0.0020 | 2026-08-12 | A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live | |
CVE-2026-50186 |
high | 8.8 | 0.0059 | 2026-08-18 | 4gaBoards is a boards system for realtime project management. Prior to 3.3.8, 4gaBoards allows an au | |
CVE-2026-52872 |
high | 8.8 | 0.0018 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2 | |
CVE-2026-102217 |
high | 8.8 | 0.0126 | 2026-10-13 | Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privilege |