Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,018 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-55629 |
high | 8.7 | 0.0055 | 2026-07-16 | Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/servic | |
CVE-2026-60027 |
high | 8.7 | 0.0052 | 2026-07-20 | Joomla Extension - themexpert.com - Unauthenticated path traversal / file read in Quix Page Builder | |
CVE-2026-47394 |
high | 8.7 | 0.0050 | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / | |
CVE-2026-15724 |
high | 8.7 | 0.0052 | 2026-07-21 | In Progress ShareFile Storage Zones Controller versions prior to 5.12.5 and 6.0.2, an authenticated | |
CVE-2026-65690 |
high | 8.7 | 0.0090 | 2026-07-23 | Bold Reports Standalone Report Designer before 14.1.12 contains a missing filepath validation vulner | |
CVE-2026-66050 |
high | 8.7 | 0.0112 | 2026-07-27 | NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer se | |
CVE-2026-67185 |
high | 8.7 | 0.0055 | 2026-07-28 | TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers | |
CVE-2026-69089 |
high | 8.7 | 0.0046 | 2026-08-03 | Grav CMS 2.0.10 contains a path traversal vulnerability in ImageMedium::watermark(), which passes it | |
CVE-2026-69095 |
high | 8.7 | 0.0093 | 2026-08-03 | OpenWrt luci-app-bmx7 before commit 5890760a454dad2cb00389dba2cdc5e779e0ffdd contains a path travers | |
CVE-2026-67200 |
high | 8.7 | 0.0085 | 2026-08-04 | Perspective 5.0.0 contains a path traversal vulnerability that allows unauthenticated remote attacke | |
CVE-2026-71476 |
high | 8.7 | 0.0086 | 2026-08-06 | Nx is a monorepo solution for TypeScript and polyglot codebases. From version 20.8.0 until 22.7.7 an | |
CVE-2026-47659 |
high | 8.7 | 0.0062 | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health da | |
CVE-2026-47661 |
high | 8.7 | 0.0062 | 2026-08-07 | Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health da | |
CVE-2026-72713 |
high | 8.7 | 0.0083 | 2026-08-11 | XAgent contains a path traversal vulnerability in the workspace file endpoint that allows self-regis | |
CVE-2026-75111 |
high | 8.7 | 0.0057 | 2026-08-17 | Evidently UI fails to properly validate the filename parameter in the dataset materialization endpoi | |
CVE-2026-75859 |
high | 8.7 | 0.0053 | 2026-08-18 | CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions fiel | |
CVE-2026-75914 |
high | 8.7 | 0.0053 | 2026-08-18 | CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool th | |
CVE-2026-76598 |
high | 8.7 | 0.0046 | 2026-08-22 | Joomla Extension - fabrikar.com - Unauthenticated arbitrary directory listing via onAjax_getFolders | |
CVE-2017-20284 |
high | 8.7 | 0.0117 | 2026-09-18 | Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that al | |
CVE-2026-63162 |
high | 8.7 | 0.0071 | 2026-10-13 | Omnispace Agora Project before 26.10.0 contains a path traversal vulnerability that allows attackers | |
CVE-2014-125133 |
high | 8.7 | 0.0112 | 2026-10-20 | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows un | |
CVE-2014-125134 |
high | 8.7 | 0.0082 | 2026-10-20 | ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthe | |
CVE-2015-20124 |
high | 8.7 | 0.0050 | 2026-10-20 | Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability t | |
CVE-2016-20100 |
high | 8.7 | 0.0053 | 2026-10-20 | Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability | |
CVE-2016-20104 |
high | 8.7 | 0.0061 | 2026-10-20 | EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability | |
CVE-2018-25439 |
high | 8.7 | 0.0047 | 2026-10-22 | MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that al | |
CVE-2019-25779 |
high | 8.7 | 0.0045 | 2026-10-22 | WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attac | |
CVE-2021-48013 |
high | 8.7 | 0.0074 | 2026-10-22 | Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to | |
CVE-2021-48015 |
high | 8.7 | 0.0056 | 2026-10-22 | JeeWMS before commit 0a610e8 contains an unauthenticated path traversal vulnerability that allows re | |
CVE-2021-48017 |
high | 8.7 | 0.0043 | 2026-10-22 | OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversa | |
CVE-2022-51024 |
high | 8.7 | 0.0039 | 2026-10-22 | Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated atta | |
CVE-2026-115355 |
high | 8.7 | 0.0046 | 2026-10-22 | Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows at | |
CVE-2026-116009 |
high | 8.7 | 0.0042 | 2026-10-24 | Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the me | |
CVE-2026-114083 |
high | 8.6 | 0.0050 | 2026-10-21 | Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/ | |
CVE-2026-115924 |
high | 8.6 | 0.0039 | 2026-10-26 | Rembg is a tool to remove images background. Prior to 2.0.82, the public /api/remove endpoint passes | |
CVE-2026-116682 |
high | 8.6 | 0.0054 | 2026-10-27 | FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to 1.5.2-stable and 2.0.1- | |
CVE-2026-3987 |
high | 8.6 | 0.0069 | 2026-04-01 | A path traversal vulnerability in the Fireware OS Web UI on WatchGuard Firebox systems may allow a p | |
CVE-2026-41690 |
high | 8.6 | 0.0031 | 2026-05-08 | 18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastif | |
CVE-2026-6282 |
high | 8.6 | 0.0039 | 2026-05-13 | A potential improper file path validation vulnerability was reported in some Lenovo Personal Cloud S | |
CVE-2026-44522 |
high | 8.6 | 0.0056 | 2026-05-14 | Note Mark is an open-source note-taking application. From 0.13.0 to before 0.19.4, the Note Mark app | |
CVE-2026-42737 |
high | 8.6 | 0.0036 | 2026-05-27 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in e4jv | |
CVE-2026-53777 |
high | 8.6 | 0.0047 | 2026-06-11 | Perry before 0.5.1159 contains a path traversal vulnerability that allows a malicious build server t | |
CVE-2026-40769 |
high | 8.6 | 0.0044 | 2026-06-15 | Unauthenticated Arbitrary File Deletion in Contact Form Extender for Divi – Save Entries, File | |
CVE-2026-27400 |
high | 8.6 | 0.0054 | 2026-06-17 | Unauthenticated Arbitrary File Deletion in BookPro <= 1.1.0 versions. | |
CVE-2026-54223 |
high | 8.6 | 0.0063 | 2026-06-18 | UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to | |
CVE-2026-56876 |
high | 8.6 | 0.0053 | 2026-06-26 | extract-zip does not validate symlink targets when extracting zip archives. When processing a malici | |
CVE-2026-55117 |
high | 8.6 | 0.0056 | 2026-07-02 | A malicious actor with access to the network could exploit a Path Traversal vulnerability found in U | |
CVE-2026-13054 |
high | 8.6 | 0.0060 | 2026-07-03 | A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged a | |
CVE-2026-57389 |
high | 8.6 | 0.0053 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Adri | |
CVE-2026-57709 |
high | 8.6 | 0.0053 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP S |