Search CVEs
Unified search with smart filters. Use vendor:apache, cwe:79, epss>=80, cvss>=9, kev:, poc: in your query.
Results for "cwe:22"
1,024 found
Export CSV
| CVE | Severity | CVSS | EPSS | Published | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-55760 |
high | 7.5 | 0.0053 | 2026-07-08 | Handlebars.java provides logic-less and semantic Mustache templates with Java. Prior to 4.5.2, appli | |
CVE-2026-57815 |
high | 7.5 | 0.0050 | 2026-07-13 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WPMU | |
CVE-2026-53598 |
high | 7.5 | 0.0129 | 2026-07-16 | Prompty is a markdown file format (.prompty) for LLM prompts. Prior to 2.0.0-beta.2, Prompty loaders | |
CVE-2026-32820 |
high | 7.5 | 0.0089 | 2026-07-20 | dataCycle is a data management system for centrally storing, managing, searching, finding, and distr | |
CVE-2026-56452 |
high | 7.5 | 0.0077 | 2026-07-20 | Path traversal in the sshd-scp component of Apache MINA SSHD. Apache MINA SSHD is a Java library for | |
CVE-2026-65754 |
high | 7.5 | 0.0050 | 2026-07-23 | Joomla Extension - regularlabs.com - Insecure path handling in ReReplacer Pro extension - ReReplacer | |
CVE-2026-15280 |
high | 7.5 | 0.0050 | 2026-07-28 | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 ND Collective Controller is aff | |
CVE-2026-55389 |
high | 7.5 | 0.0055 | 2026-07-28 | datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct fr | |
CVE-2026-55390 |
high | 7.5 | 0.0055 | 2026-07-28 | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.6 | |
CVE-2026-14519 |
high | 7.5 | 0.0062 | 2026-07-30 | IBM App Connect Enterprise 13.0.1.0 through 13.0.7.2, and 12.0.1.0 through 12.0.12.27 could allow a | |
CVE-2026-62663 |
high | 7.5 | 0.0040 | 2026-07-30 | Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.4, | |
CVE-2026-12942 |
high | 7.5 | 0.0062 | 2026-07-30 | IBM Langflow OSS 1.0.0 through 1.10.1 could allow a remote attacker to traverse directories on the s | |
CVE-2026-56671 |
high | 7.5 | 0.0097 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.2 | |
CVE-2026-56673 |
high | 7.5 | 0.0063 | 2026-07-31 | ComfyUI is a modular diffusion model GUI, API, and backend with a graph-and-node interface. Prior to | |
CVE-2026-62999 |
high | 7.5 | 0.0044 | 2026-07-31 | Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent- | |
CVE-2026-61372 |
high | 7.5 | 0.0081 | 2026-08-03 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apac | |
CVE-2026-47612 |
high | 7.5 | 0.0082 | 2026-08-04 | NVIDIA Dynamo for Linux contains a vulnerability in the image loading component where an attacker ma | |
CVE-2026-71209 |
high | 7.5 | 0.0225 | 2026-08-05 | audiobookshelf's authentication-exemption check (server/routers/Auth.js) matches unauthenticated-all | |
CVE-2026-12609 |
high | 7.5 | 0.0164 | 2026-08-05 | In Eclipse Theia versions 1.66.0 and up until including 1.73.1, the `@theia/plugin-ext` backend expo | |
CVE-2026-46581 |
high | 7.5 | 0.0056 | 2026-08-05 | In Eclipse Mojarra versions 2.3 and following, URL handing in `DefaultFaceletFactory` does not prope | |
CVE-2026-61891 |
high | 7.5 | 0.0053 | 2026-08-05 | In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP f | |
CVE-2026-72571 |
high | 7.5 | 0.0115 | 2026-08-10 | A path traversal vulnerability in mustafaakin/cast-localvideo (all versions) allows an unauthenticat | |
CVE-2026-72572 |
high | 7.5 | 0.0115 | 2026-08-10 | A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attac | |
CVE-2026-72602 |
high | 7.5 | 0.0074 | 2026-08-11 | A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenti | |
CVE-2026-61980 |
high | 7.5 | 0.0050 | 2026-08-13 | Unauthenticated Arbitrary File Download in OMGF Pro <= 5.2.7 versions. | |
CVE-2026-50776 |
high | 7.5 | 0.0180 | 2026-08-17 | Directory Traversal vulnerability in Pronis Loisirs Billetterie CSE - < 04/2026 allows a remote atta | |
CVE-2026-67918 |
high | 7.5 | 0.0136 | 2026-08-17 | Directory Traversal vulnerability in hermes-studio v.0.6.26 allows a remote attacker to obtain sensi | |
CVE-2026-15585 |
high | 7.5 | 0.0050 | 2026-08-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN | |
CVE-2026-73181 |
high | 7.5 | 0.0050 | 2026-08-18 | Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 ver | |
CVE-2025-57231 |
high | 7.5 | 0.0173 | 2026-09-10 | Path Traversal in avatar attachments in Docmost v0.21.0 allows an unauthenticated malicious actor to | |
CVE-2026-75887 |
high | 7.5 | 0.0053 | 2026-09-23 | A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal | |
CVE-2026-115497 |
high | 7.5 | 0.0089 | 2026-10-23 | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in a | |
CVE-2026-56833 |
high | 7.5 | 0.0046 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dy | |
CVE-2026-56834 |
high | 7.5 | 0.0037 | 2026-10-23 | PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dy | |
CVE-2026-118758 |
high | 7.5 | — | 2026-10-29 | Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. | |
CVE-2026-55201 |
high | 7.4 | 0.0030 | 2026-06-17 | Evil-WinRM through 3.9, fixed in commit 6ecd570, contains a path traversal vulnerability in the down | |
CVE-2026-28189 |
high | 7.4 | 0.0043 | 2026-08-13 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions. | |
CVE-2026-115908 |
high | 7.4 | 0.0043 | 2026-10-26 | zip is a zip library for Rust that supports reading and writing simple ZIP files. From 7.2.0 until 9 | |
CVE-2024-32386 |
high | 7.3 | 0.0085 | 2026-07-16 | Directory traversal vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_2020080313204 | |
CVE-2026-114098 |
high | 7.3 | 0.0015 | 2026-10-21 | Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allo | |
CVE-2026-70161 |
high | 7.3 | 0.0049 | 2026-10-13 | Improper limitation of a pathname to a restricted directory ('path traversal') in .NET allows an aut | |
CVE-2026-39306 |
high | 7.3 | 0.0029 | 2026-04-07 | PraisonAI is a multi-agent teams system. Prior to 1.5.113, PraisonAI's recipe registry pull flow ext | |
CVE-2026-35338 |
high | 7.3 | 0.0018 | 2026-04-22 | A vulnerability in the chmod utility of uutils coreutils allows users to bypass the --preserve-root | |
CVE-2026-43870 |
high | 7.3 | 0.0038 | 2026-05-05 | Origin Validation Error, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversa | |
CVE-2026-114097 |
high | 7.3 | 0.0019 | 2026-10-21 | Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_inde | |
CVE-2026-58257 |
high | 7.2 | 0.0047 | 2026-10-27 | GRR is a resource management and reservation application. Prior to the advisory-reported fixed versi | |
CVE-2025-34248 |
high | 7.2 | 0.0066 | 2025-10-09 | D-Link Nuclias Connect firmware versions < 1.3.1.4 contain a directory traversal vulnerability withi | |
CVE-2026-27101 |
high | 7.2 | 0.0040 | 2026-04-01 | Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application version(s) 5.28.00.xx to 5.32.00.xx, | |
CVE-2026-5966 |
high | 7.2 | 0.0041 | 2026-04-20 | ThreatSonar Anti-Ransomware developed by TeamT5 has an Arbitrary File Deletion vulnerability. Authen | |
CVE-2026-6832 |
high | 7.2 | 0.0047 | 2026-04-21 | Hermes WebUI contains an arbitrary file deletion vulnerability in the /api/session/delete endpoint t |