CWE-35
CVEs classified under CWE-35, newest first.
14 CVEsRSS
CVE-2026-27557High· 7.5An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.
CVE-2026-85310Medium· 6.5import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.
CVE-2026-21103Medium· 6.1Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege.
Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege.
CVE-2026-21092Medium· 5.3⚖ disputedPath traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.
Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege.
CVE-2026-20513Medium· 4.4In Audio HAL, there is a possible information disclosure due to improper input validation
In Audio HAL, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for…
CVE-2026-59115Critical· 9.9Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.
GHSA-phv5-334h-mxcwCriticalmotionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
motionEye Partial Authentication Bypass: Unauthenticated Admin Credential Theft via Path Traversal
CVE-2026-45661Critical· 9.9Dokploy is a free, self-hostable Platform as a Service (PaaS)
Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.5 and earlier, a critical path traversal vulnerability exists in Dokploy v0.26.5 that allows authenticated users to write arbitrary files to the filesystem during app…
CVE-2026-20034High· 8.8A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of use…
A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This vulnerability is due to insufficient validation of use…
CVE-2026-28265Medium· 4.4PowerStore, contains a Path Traversal vulnerability in the Service user
PowerStore, contains a Path Traversal vulnerability in the Service user. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system files.
CVE-2025-68428High· 7.5PoCjsPDF is a library to generate PDFs in JavaScript
jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given the possibility to pass unsani…
CVE-2025-20313Medium· 6.7Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and brea…
Multiple vulnerabilities in Cisco IOS XE Software of could allow an authenticated, local attacker with level-15 privileges or an unauthenticated attacker with physical access to the device to execute persistent code at boot time and brea…
CVE-2025-8088High· 8.8CISA KEVPoCA path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files
A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This vulnerability was exploited in the wild and was discovered by Anton Cherepano…
CVE-2024-54216High· 7.7Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.
Path Traversal: '.../...//' vulnerability in reputeinfosystems ARForms allows Path Traversal. This issue affects ARForms: from n/a before 7.0.2.