Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,018 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-61443 |
high | 8.6 | 0.0064 | 2026-07-15 | PraisonAI before 1.6.78 contains a remote code execution vulnerability in SkillTools.run_skill_scrip | |
CVE-2026-44023 |
high | 8.6 | 0.0043 | 2026-07-16 | Docling Core defines core data types and transformations for the document processing application Doc | |
CVE-2026-15343 |
high | 8.6 | 0.0075 | 2026-07-17 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker w | |
CVE-2026-66397 |
high | 8.6 | 0.0040 | 2026-07-27 | phpMyFAQ before 4.1.6 fails to validate path traversal sequences in the existing_image field during | |
CVE-2026-54650 |
high | 8.6 | 0.0053 | 2026-07-28 | openhole exposes localhost to the internet in one command. In 0.1.1 and earlier, openhole-server in | |
CVE-2026-48441 |
high | 8.6 | 0.0031 | 2026-08-11 | Lightroom Classic is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Pa | |
CVE-2026-16616 |
high | 8.6 | 0.0073 | 2026-08-19 | The Simple File List WordPress plugin through 6.3.11 does not validate the source path of a file-mov | |
CVE-2026-8069 |
high | 8.5 | 0.0012 | 2026-05-08 | PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability. | |
CVE-2026-43989 |
high | 8.5 | 0.0015 | 2026-05-12 | JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, the upload_wasm | |
CVE-2026-9789 |
high | 8.5 | 0.0015 | 2026-05-28 | A Local Privilege Escalation (LPE) vulnerability affects Acer NitroSense software versions prior to | |
CVE-2026-47826 |
high | 8.5 | 0.0054 | 2026-07-09 | The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbi | |
CVE-2026-73079 |
high | 8.5 | 0.0039 | 2026-08-11 | Sub2API is an AI API gateway platform designed to distribute and manage API quotas from AI product s | |
CVE-2026-16033 |
high | 8.5 | 0.0047 | 2026-08-12 | A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unco | |
CVE-2026-76832 |
high | 8.5 | 0.0126 | 2026-08-19 | Agno's PythonTools in libs/agno/agno/tools/python.py contains a path traversal vulnerability that al | |
CVE-2026-74043 |
high | 8.5 | 0.0036 | 2026-10-13 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_r | |
CVE-2026-35570 |
high | 8.4 | 0.0023 | 2026-04-21 | OpenClaude is an open-source coding-agent command line interface for cloud and local model providers | |
CVE-2026-41211 |
high | 8.4 | 0.0031 | 2026-04-23 | Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `download | |
CVE-2026-41433 |
high | 8.4 | 0.0019 | 2026-04-24 | OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard | |
CVE-2026-42881 |
high | 8.4 | 0.0023 | 2026-05-14 | STIGQter is an open-source reimplementation of DISA's STIG Viewer. From 0.1.2 to before 1.2.7, an at | |
CVE-2026-52752 |
high | 8.4 | 0.0022 | 2026-06-10 | Ghidra before 12.0.2 contains a path traversal vulnerability in the extension installer that fails t | |
CVE-2026-52755 |
high | 8.4 | 0.0022 | 2026-06-10 | Ghidra before 12.0.4 contains a path traversal vulnerability in the theme import functionality that | |
CVE-2026-56844 |
high | 8.4 | 0.0017 | 2026-07-22 | A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a lo | |
CVE-2026-47764 |
high | 8.4 | 0.0020 | 2026-08-04 | pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior t | |
CVE-2026-46345 |
high | 8.4 | 0.0020 | 2026-08-17 | compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 a | |
CVE-2026-75855 |
high | 8.4 | 0.0055 | 2026-08-18 | ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint' | |
CVE-2026-52875 |
high | 8.4 | 0.0016 | 2026-08-18 | Streambert is a cross-platform Electron Desktop App to stream and download video content. Prior to 2 | |
CVE-2026-74033 |
high | 8.4 | 0.0034 | 2026-10-13 | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete | |
CVE-2026-63120 |
high | 8.4 | 0.0040 | 2026-10-23 | pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object st | |
CVE-2026-59179 |
high | 8.3 | 0.0039 | 2026-10-28 | OpenHop is a tool for creating interactive data-flow diagrams. Prior to 0.3.7, `@openhop/server` pas | |
CVE-2026-31939 |
high | 8.3 | 0.0035 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exe | |
CVE-2026-8464 |
high | 8.3 | 0.0020 | 2026-06-11 | Golem OEE MES is vulnerable to an unauthenticated path traversal flaw. This vulnerability allows an | |
CVE-2026-56448 |
high | 8.3 | 0.0044 | 2026-06-22 | A path traversal vulnerability exists in AIL Framework before the release containing commit 0041456a | |
CVE-2026-45576 |
high | 8.3 | 0.0050 | 2026-07-16 | zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `z | |
CVE-2026-65878 |
high | 8.3 | 0.0049 | 2026-07-27 | Joomla Extension - joomshaper.com - Authenticated arbitrary file delete in SP Page Builder < 6.7.1- | |
CVE-2026-69086 |
high | 8.3 | 0.0053 | 2026-08-03 | SiYuan versions before v3.7.3 fail to validate the avID parameter on all code branches in attribute- | |
CVE-2026-75842 |
high | 8.3 | 0.0046 | 2026-08-18 | ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD | |
CVE-2026-109956 |
high | 8.3 | 0.0032 | 2026-10-13 | NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers | |
CVE-2026-15061 |
high | 8.2 | 0.0059 | 2026-08-19 | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 's nimesis registration service could allow a remote a | |
CVE-2022-42476 |
high | 8.2 | 0.0022 | 2023-03-07 | A relative path traversal vulnerability [CWE-23] vulnerability in Fortinet FortiOS 7.2.0 through 7.2 | |
CVE-2026-33748 |
high | 8.2 | 0.0048 | 2026-03-27 | BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and | |
CVE-2026-42353 |
high | 8.2 | 0.0039 | 2026-05-08 | i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fasti | |
CVE-2026-42564 |
high | 8.2 | 0.0116 | 2026-05-11 | jotty·page is a self-hosted app for your checklists and notes. Prior to 1.22.0, an unauthenticated p | |
CVE-2026-45017 |
high | 8.2 | 0.0034 | 2026-05-28 | Python Liquid is a Python engine for the Liquid template language. Prior to 2.2.0, the built-in File | |
CVE-2026-49982 |
high | 8.2 | 0.0050 | 2026-06-11 | tmp is a temporary file and directory creator for node.js. In version 0.2.6, the _assertPath guard a | |
CVE-2026-53571 |
high | 8.2 | 0.0058 | 2026-06-22 | Vite is a frontend tooling framework for JavaScript. Prior to 8.0.16, 7.3.5, and 6.4.3, the contents | |
CVE-2026-58467 |
high | 8.2 | 0.0173 | 2026-07-02 | Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that all | |
CVE-2026-58499 |
high | 8.2 | 0.0054 | 2026-07-10 | EverOS is a memory runtime for agents. Prior to 1.0.1, EverOS is vulnerable to path traversal in the | |
CVE-2026-45309 |
high | 8.2 | 0.0059 | 2026-07-17 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the | |
CVE-2026-45711 |
high | 8.2 | 0.0039 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump - | |
CVE-2026-43772 |
high | 8.2 | 0.0019 | 2026-07-27 | A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Se |