Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,024 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-45309 |
high | 8.2 | 0.0059 | 2026-07-17 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the | |
CVE-2026-45711 |
high | 8.2 | 0.0039 | 2026-07-20 | Mailpit is an email testing tool and API for developers. Prior to version 1.30.0, the mailpit dump - | |
CVE-2026-43772 |
high | 8.2 | 0.0019 | 2026-07-27 | A path traversal issue was addressed with improved input validation. This issue is fixed in macOS Se | |
CVE-2026-66491 |
high | 8.2 | 0.0047 | 2026-08-07 | Joomla Extension - phoca.cz - Arbitrary File Read in Phoca Commander 1.0.0-6.1.3 - Improper limitati | |
CVE-2026-74907 |
high | 8.2 | 0.0043 | 2026-08-18 | Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.p | |
CVE-2026-92709 |
high | 8.1 | 0.0030 | 2026-10-22 | Rsyslog is a rocket-fast system for log processing. From versions 1.15.0 to 8.2610.0, rsyslog's omfi | |
CVE-2026-34728 |
high | 8.1 | 0.0069 | 2026-04-02 | phpMyFAQ is an open source FAQ web application. Prior to version 4.1.1, the MediaBrowserController:: | |
CVE-2026-34783 |
high | 8.1 | 0.0051 | 2026-04-06 | Ferret is a declarative system for working with web data. Prior to 2.0.0-alpha.4, a path traversal v | |
CVE-2026-35167 |
high | 8.1 | 0.0033 | 2026-04-06 | Kedro is a toolbox for production-ready data science. Prior to 1.3.0, the _get_versioned_path() meth | |
CVE-2026-39307 |
high | 8.1 | 0.0031 | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, The PraisonAI templates installation feat | |
CVE-2026-41058 |
high | 8.1 | 0.0047 | 2026-04-21 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the incomplete fix for AVi | |
CVE-2026-42075 |
high | 8.1 | 0.0064 | 2026-05-04 | Evolver is a GEP-powered self-evolving engine for AI agents. Prior to version 1.69.3, a path travers | |
CVE-2026-46402 |
high | 8.1 | 0.0075 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0. | |
CVE-2026-11816 |
high | 8.1 | 0.0056 | 2026-06-11 | Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction ut | |
CVE-2026-8442 |
high | 8.1 | 0.0052 | 2026-06-16 | The WP Review Slider Pro plugin for WordPress is vulnerable to Arbitrary File Deletion in versions u | |
CVE-2026-49340 |
high | 8.1 | 0.0031 | 2026-06-19 | gonic is a music streaming server / free-software subsonic server API implementation. Prior to versi | |
CVE-2026-49297 |
high | 8.1 | 0.0099 | 2026-07-06 | Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator | |
CVE-2026-54591 |
high | 8.1 | 0.0049 | 2026-07-08 | AsyncSSH is a Python package which provides an asynchronous client and server implementation of the | |
CVE-2026-7872 |
high | 8.1 | 0.0062 | 2026-07-17 | IBM Langflow OSS 1.0.0 through 1.10.0 allows an authenticated attacker to read arbitrary files inclu | |
CVE-2026-13186 |
high | 8.1 | 0.0073 | 2026-07-22 | In Progress® Telerik® UI for AJAX prior to v2026.2.708, a path traversal vulnerability in the file-b | |
CVE-2026-62391 |
high | 8.1 | 0.0079 | 2026-07-31 | The security fix for CVE-2025-66518 is incomplete. Any client who can access to Apache Kyuubi Server | |
CVE-2026-72903 |
high | 8.1 | 0.0049 | 2026-08-10 | Tabby (formerly Terminus) is a highly configurable terminal emulator. Prior to 1.0.235, a malicious | |
CVE-2026-19594 |
high | 8.1 | 0.0050 | 2026-08-12 | Insufficient input sanitization in Snowflake Python API (`snowflake.core`) versions prior to 1.13.0 | |
CVE-2026-19942 |
high | 8.1 | 0.0108 | 2026-08-19 | The Atarim – AI Agency for WordPress: Edit Pages, Fix Code, Update Plugins, SEO & Client Feedback pl | |
CVE-2026-57113 |
high | 8.1 | 0.0040 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's te | |
CVE-2026-93851 |
high | 8.0 | 0.0027 | 2026-10-28 | Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10 fail to validate the targe | |
CVE-2026-71279 |
high | 8.0 | 0.0057 | 2026-08-05 | Zigbee2MQTT's ExternalJSExtension.getFilePath (lib/extension/externalJS.ts) joins a parameter receiv | |
CVE-2026-15801 |
high | 8.0 | 0.0048 | 2026-09-21 | A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI | |
CVE-2026-41082 |
high | 7.8 | 0.0021 | 2026-04-16 | In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach | |
CVE-2026-40491 |
high | 7.8 | 0.0057 | 2026-04-18 | gdown is a Google Drive public file/folder downloader. Versions prior to 5.2.2 are vulnerable to a P | |
CVE-2026-28915 |
high | 7.8 | 0.0018 | 2026-05-11 | A parsing issue in the handling of directory paths was addressed with improved path validation. This | |
CVE-2026-44171 |
high | 7.8 | 0.0019 | 2026-06-12 | MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26 | |
CVE-2026-11940 |
high | 7.8 | 0.0075 | 2026-06-23 | tarfile.extractall() with the 'data' or 'tar' filter could be bypassed by a crafted archive where a | |
CVE-2026-53925 |
high | 7.8 | 0.0019 | 2026-06-25 | Glances is an open-source system cross-platform monitoring tool. From 4.0.8 until 4.5.5, the secure_ | |
CVE-2026-22927 |
high | 7.8 | 0.0018 | 2026-07-08 | Omnissa Workspace ONE® Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. | |
CVE-2026-55878 |
high | 7.8 | 0.0019 | 2026-07-08 | Symfony UX is a JavaScript ecosystem for Symfony. From 2.32.0 before 2.36.1 and from 3.0.0 before 3. | |
CVE-2026-50757 |
high | 7.8 | 0.0063 | 2026-07-21 | Directory Traversal vulnerability in DayuanJiang next-ai-draw-io 0.4.13 allowsa remote attacker to e | |
CVE-2026-65600 |
high | 7.8 | 0.0062 | 2026-07-22 | Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authenticatio | |
CVE-2026-14985 |
high | 7.8 | 0.0017 | 2026-07-22 | The Analog Way Picturall Quad Compact Mark II version 3.5.8, contains a local privilege escalation v | |
CVE-2026-43749 |
high | 7.8 | 0.0019 | 2026-07-27 | A parsing issue in the handling of directory paths was addressed with improved path validation. This | |
CVE-2026-48374 |
high | 7.8 | 0.0031 | 2026-07-28 | Bridge is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversa | |
CVE-2026-76479 |
high | 7.8 | 0.0019 | 2026-10-21 | As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams f | |
CVE-2026-40180 |
high | 7.7 | 0.0039 | 2026-04-10 | Quarkus OpenAPI Generator is Quarkus' extensions for generation of Rest Clients and server stubs gen | |
CVE-2026-34242 |
high | 7.7 | 0.0046 | 2026-04-15 | Weblate is a web based localization tool. In versions prior to 5.17, the ZIP download feature didn't | |
CVE-2026-39861 |
high | 7.7 | 0.0071 | 2026-04-21 | Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not preven | |
CVE-2026-41205 |
high | 7.7 | 0.0036 | 2026-04-23 | Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vuln | |
CVE-2026-44705 |
high | 7.7 | 0.0043 | 2026-06-11 | tmp is a temporary file and directory creator for node.js. Prior to 0.2.6, the tmp npm package conta | |
CVE-2026-40779 |
high | 7.7 | 0.0033 | 2026-06-15 | Contributor Arbitrary File Deletion in Link Library <= 7.8.8 versions. | |
CVE-2026-54193 |
high | 7.7 | 0.0033 | 2026-06-17 | Contributor Arbitrary File Deletion in Fusion Builder <= 3.15.4 versions. | |
CVE-2026-42129 |
high | 7.7 | 0.0044 | 2026-06-22 | A user with Viewer permissions can use a path traversal in the Loki data source plugin to reach admi |