On this page
Atomicorp WAF Rule 347009
Rule Summary
- Rule ID: 347009
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Protected File access denied
- Observed CWEs: CWE-17 (1), CWE-20 (25), CWE-22 (708), CWE-23 (6), CWE-24 (4), CWE-26 (1), CWE-29 (2), CWE-35 (2), CWE-36 (2), CWE-59 (2), CWE-73 (27), CWE-74 (27), CWE-77 (44), CWE-78 (151), CWE-79 (9), CWE-88 (3), CWE-89 (17), CWE-91 (1), CWE-93 (3), CWE-94 (61), CWE-95 (7), CWE-98 (18), CWE-120 (1), CWE-121 (1), CWE-177 (1), CWE-180 (1), CWE-183 (1), CWE-184 (5), CWE-200 (34), CWE-201 (1), CWE-209 (1), CWE-250 (2), CWE-264 (1), CWE-269 (3), CWE-276 (2), CWE-284 (16), CWE-285 (4), CWE-287 (9), CWE-288 (1), CWE-295 (1), CWE-306 (13), CWE-319 (1), CWE-330 (1), CWE-345 (2), CWE-346 (2), CWE-350 (1), CWE-352 (3), CWE-362 (1), CWE-367 (6), CWE-400 (3), CWE-427 (2), CWE-434 (22), CWE-441 (4), CWE-444 (1), CWE-470 (5), CWE-472 (2), CWE-489 (1), CWE-497 (2), CWE-501 (1), CWE-502 (2), CWE-552 (9), CWE-601 (1), CWE-610 (4), CWE-611 (5), CWE-625 (1), CWE-639 (5), CWE-641 (1), CWE-642 (1), CWE-644 (1), CWE-665 (1), CWE-668 (2), CWE-669 (1), CWE-693 (4), CWE-697 (1), CWE-704 (1), CWE-706 (2), CWE-732 (3), CWE-749 (1), CWE-770 (1), CWE-776 (1), CWE-787 (1), CWE-791 (1), CWE-798 (5), CWE-824 (1), CWE-829 (4), CWE-835 (1), CWE-862 (16), CWE-863 (5), CWE-913 (1), CWE-915 (1), CWE-917 (1), CWE-918 (247), CWE-1188 (4), CWE-1220 (1), CWE-1321 (1), CWE-1336 (2), CWE-1389 (1), CWE-1392 (1)
- Revision: 1
- Rule severity: Critical (2)
- Phase: 1 (request headers)
- Request surfaces: Request URI
- Rule action: deny
- HTTP status: 403
- Logging: log, auditlog
Description
This rule detects behavior identified by its current alert as “Protected File access denied” in the request URI. It evaluates during the request headers phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2009-0545 | ZeroShell Remote Code Execution | zeroshell | 10.0 (v2.0) | High |
| CVE-2010-5286 | Joomla! Component Jstore - 'Controller' Local File Inclusion | com jstore | 10.0 (v2.0) | High |
| CVE-2013-4822 | HP Intelligent Management Center BIMS UploadServlet Directory Traversal | imc branch intelligent management system software module | 10.0 (v2.0) | High |
| CVE-2015-0779 | Novell ZENworks Configuration Management Arbitrary File Upload | zenworks configuration management | 10.0 (v2.0) | High |
| CVE-2019-11510 | Pulse Secure VPN Arbitrary File Disclosure | connect secure | 10.0 (v3.1) | Critical |
| CVE-2025-34037 | Linksys E-Series TheMoon Remote Command Injection | E4200 | 10.0 (v4.0) | Critical |
| CVE-2025-49132 | Pterodactyl Panel CVE-2025-49132 Remote Code Execution | panel | 10.0 (v3.1) | Critical |
| CVE-2026-100382 | Unauthenticated remote code execution through wikitext in ExternalData | Mediawiki - ExternalData Extension | 10.0 (v4.0) | Critical |
| CVE-2026-105134 | Ahsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection | cloud backup suite | 10.0 (v4.0) | Critical |
| CVE-2026-108576 | TOZED X300 IPPingDiagnostics process_ping os command injection | X300 | 10.0 (v4.0) | Critical |
| CVE-2026-11414 | Unauthenticated File Exfiltration in Altium Enterprise Server Vault Service via Hard-coded Cryptographic Key and Path Tr | on-prem enterprise server | 10.0 (v4.0) | Critical |
| CVE-2026-33712 | TypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls | typebot.io | 10.0 (v3.1) | Critical |
| CVE-2026-41900 | OpenLearnX has Critical Remote Code Execution Through Python Sandbox Escape via Code Execution Environment | openlearnx | 10.0 (v3.1) | Critical |
| CVE-2026-49869 | Kestra: Unauthenticated Remote Code Execution via Authentication Bypass in AuthenticationFilter | kestra | 10.0 (v3.1) | Critical |
| CVE-2026-54745 | Kubeflow Pipelines: Unauthenticated SSRF and HTTP smuggling in Kubeflow Pipelines frontend /_proxy/ route, bypasses ENAB | pipelines | 10.0 (v3.1) | Critical |
| CVE-2026-7411 | Eclipse BaSyx Arbitrary Code Execution Vulnerability | Eclipse BaSyx | 10.0 (v3.1) | Critical |
| CVE-2026-85706 | GitLab Unauthenticated Arbitrary File Read | gitlab | 10.0 (v3.1) | Critical |
| CVE-2025-11539 | Arbitrary Code Execution in Grafana Image Renderer Plugin | grafana-image-renderer | 9.9 (v3.1) | Critical |
| CVE-2026-105697 | Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server configuration | langflow | 9.9 (v3.1) | Critical |
| CVE-2026-108390 | HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking | hestiacp | 9.9 (v3.1) | Critical |
| CVE-2026-113708 | Argo CD: A Kustomize remote ref can run commands in the repo-server | argo-cd | 9.9 (v3.1) | Critical |
| CVE-2026-31818 | Budibase: Server-Side Request Forgery via REST Connector with Empty Default Blacklist | budibase | 9.9 (v3.1) | Critical |
| CVE-2026-34038 | Coolify authenticated remote command injection leading to RCE and secret exfiltration | coolify | 9.9 (v3.1) | Critical |
| CVE-2026-40089 | Sonicverse has Server-Side Request Forgery via user-controlled URLs in dashboard API client | radio audio streaming stack | 9.9 (v3.1) | Critical |
| CVE-2026-42454 | Termix: OS Command Injection in Docker Container Management Endpoints | Termix | 9.9 (v3.1) | Critical |
| CVE-2026-43986 | Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay | Tautulli | 9.9 (v3.1) | Critical |
| CVE-2026-45629 | Dokploy: Authenticated Remote Code Execution via Command Injection in /listen-deployment WebSocket Endpoint | dokploy | 9.9 (v3.1) | Critical |
| CVE-2026-55565 | Yamcs: Authenticated remote code execution via unescaped StreamSQL LIKE pattern compiled by Janino (LikeExpression) | yamcs | 9.9 (v3.1) | Critical |
| CVE-2026-72738 | Dokploy: Authenticated RCE via Command Injection in backup.listBackupFiles search Parameter | dokploy | 9.9 (v3.1) | Critical |
| CVE-2026-72869 | Dokploy: Authenticated OS command injection in backup.restoreBackupWithLogs (databaseName) leading to host RCE | dokploy | 9.9 (v3.1) | Critical |
| CVE-2026-72876 | Dokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.* | dokploy | 9.9 (v3.1) | Critical |
| CVE-2026-73294 | Semaphore U: OS Command Injection | semaphore | 9.9 (v3.1) | Critical |
| CVE-2026-93698 | cPanel OS Command Injection Vulnerability | cPanel | 9.9 (v3.0) | Critical |
| CVE-2010-2861 | ColdFusion Server Check | coldfusion | 9.8 (v3.1) | Critical |
| CVE-2016-2555 | ATutor 2.2.1 SQL Injection / Remote Code Execution | atutor | 9.8 (v3.0) | Critical |
| CVE-2016-6600 | WebNMS Framework Server Arbitrary File Upload | webnms framework | 9.8 (v3.0) | Critical |
| CVE-2017-1000002 | ATutor 2.2.1 Directory Traversal / Remote Code Execution | atutor | 9.8 (v3.0) | Critical |
| CVE-2017-12611 | Apache Struts2 S2-053 - Remote Code Execution | struts | 9.8 (v3.0) | Critical |
| CVE-2017-12629 | Apache Solr XML External Entity Injection (CVE-2017-12629) | solr | 9.8 (v3.1) | Critical |
| CVE-2017-7462 | Intellinet NFC-30IR Camera - Multiple Vulnerabilities | nfc-30ir firmware | 9.8 (v3.0) | Critical |
| CVE-2018-12031 | Eaton Intelligent Power Manager 1.6 - Directory Traversal | intelligent power manager | 9.8 (v3.0) | Critical |
| CVE-2018-14064 | VelotiSmart Wifi - Directory Traversal | velotismart wifi firmware | 9.8 (v3.0) | Critical |
| CVE-2018-16283 | WordPress Plugin Wechat Broadcast 1.2.0 - Local File Inclusion | wechat brodcast | 9.8 (v3.0) | Critical |
| CVE-2018-16763 | FUEL CMS 1.4.1 - Remote Code Execution | fuel cms | 9.8 (v3.1) | Critical |
| CVE-2018-16836 | Rubedo CMS <=3.4.0 - Directory Traversal | rubedo | 9.8 (v3.1) | Critical |
| CVE-2018-17246 | Kibana - Local File Inclusion | kibana | 9.8 (v3.0) | Critical |
| CVE-2018-17552 | Navigate CMS Unauthenticated Remote Code Execution | navigate cms | 9.8 (v3.0) | Critical |
| CVE-2019-12314 | Deltek Maconomy 2.2.5 - Local File Inclusion | maconomy | 9.8 (v3.0) | Critical |
| CVE-2019-12725 | Zeroshell 3.9.0 - Remote Command Execution | zeroshell | 9.8 (v3.0) | Critical |
| CVE-2019-16662 | rConfig 3.9.2 - Remote Code Execution | rconfig | 9.8 (v3.1) | Critical |
| CVE-2019-17270 | Yachtcontrol Webapplication 1.0 - Remote Command Injection | yachtcontrol | 9.8 (v3.1) | Critical |
| CVE-2019-7192 | QNAP QTS and Photo Station Local File Inclusion | photo station | 9.8 (v3.1) | Critical |
| CVE-2019-7194 | QNAP QTS and Photo Station Local File Inclusion | photo station | 9.8 (v3.1) | Critical |
| CVE-2019-7195 | QNAP QTS and Photo Station Local File Inclusion | photo station | 9.8 (v3.1) | Critical |
| CVE-2019-7256 | Linear eMerge E3-Series Access Controller Command Injection | linear emerge essential firmware | 9.8 (v3.1) | Critical |
| CVE-2019-9194 | elFinder PHP Connector exiftran Command Injection | elfinder | 9.8 (v3.0) | Critical |
| CVE-2019-9618 | WordPress GraceMedia Media Player 1.0 - Local File Inclusion | gracemedia media player | 9.8 (v3.0) | Critical |
| CVE-2019-9960 | LimeSurvey Zip Path Traversals | limesurvey | 9.8 (v3.0) | Critical |
| CVE-2020-11455 | LimeSurvey Zip Path Traversals | limesurvey | 9.8 (v3.1) | Critical |
| CVE-2020-15568 | TerraMaster TOS <.1.29 - Remote Code Execution | tos | 9.8 (v3.1) | Critical |
| CVE-2020-15920 | Mida Solutions eFramework ajaxreq.php Command Injection | eframework | 9.8 (v3.1) | Critical |
| CVE-2020-17530 | Struts2 S2-061 Remote Code Execution Vulnerablity (CVE-2020-17530) | struts | 9.8 (v3.1) | Critical |
| CVE-2020-29227 | Car Rental Management System 1.0 - Local File Inclusion | car rental management system | 9.8 (v3.1) | Critical |
| CVE-2020-29390 | Zeroshell 3.9.3 - Command Injection | zeroshell | 9.8 (v3.1) | Critical |
| CVE-2020-3243 | Cisco UCS Director Cloupia Script RCE | ucs director | 9.8 (v3.1) | Critical |
| CVE-2020-3250 | Cisco UCS Director Cloupia Script RCE | ucs director | 9.8 (v3.1) | Critical |
| CVE-2020-4427 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-4429 | IBM Data Risk Manager Unauthenticated Remote Code Execution | data risk manager | 9.8 (v3.1) | Critical |
| CVE-2020-5902 | F5 BIG-IP TMUI Directory Traversal and File Upload RCE | big-ip access policy manager | 9.8 (v3.1) | Critical |
| CVE-2020-7209 | LinuxKI Toolset <= 6.01 - Remote Command Execution | linuxki | 9.8 (v3.1) | Critical |
| CVE-2020-9054 | Zyxel NAS Firmware 5.21- Remote Code Execution | nas326 firmware | 9.8 (v3.1) | Critical |
| CVE-2021-21307 | Lucee Administrator imgProcess.cfm Arbitrary File Write | lucee server | 9.8 (v3.1) | Critical |
| CVE-2021-22005 | VMware vCenter Server Analytics (CEIP) Service File Upload | cloud foundation | 9.8 (v3.1) | Critical |
| CVE-2021-32682 | elFinder ZIP Arguments Injection Leads to Commands Injection (CVE-2021-32682) | elfinder | 9.8 (v3.1) | Critical |
| CVE-2021-40960 | Galera WebTemplate 1.0 Directory Traversal | galera webtemplate | 9.8 (v3.1) | Critical |
| CVE-2021-41773 | Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.49 (CVE-2021-41773) | http server | 9.8 (v3.1) | Critical |
| CVE-2021-42013 | Path traversal and file disclosure vulnerability in Apache HTTP Server 2.4.50 (CVE-2021-42013) | http server | 9.8 (v3.1) | Critical |
| CVE-2021-45837 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 9.8 (v3.1) | Critical |
| CVE-2022-1390 | WordPress Admin Word Count Column 2.2 - Local File Inclusion | admin word count column | 9.8 (v3.1) | Critical |
| CVE-2022-1391 | WordPress Cab fare calculator < 1.0.4 - Local File Inclusion | cab fare calculator | 9.8 (v3.1) | Critical |
| CVE-2022-2143 | Advantech iView NetworkServlet Command Injection | iview | 9.8 (v3.1) | Critical |
| CVE-2022-28219 | ManageEngine ADAudit Plus CVE-2022-28219 | manageengine adaudit plus | 9.8 (v3.1) | Critical |
| CVE-2022-29806 | ZoneMinder Language Settings Remote Code Execution | zoneminder | 9.8 (v3.1) | Critical |
| CVE-2022-32409 | Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion | i3geo | 9.8 (v3.1) | Critical |
| CVE-2022-36553 | Hytec Inter HWL-2511-SS - Remote Command Execution | hwl-2511-ss firmware | 9.8 (v3.1) | Critical |
| CVE-2022-36642 | Omnia MPX 1.5.0+r1 - Local File Inclusion | omnia mpx node firmware | 9.8 (v3.1) | Critical |
| CVE-2022-37042 | Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925) | zimbra collaboration suite | 9.8 (v3.1) | Critical |
| CVE-2022-4060 | WordPress User Post Gallery <=2.19 - Remote Code Execution | user post gallery | 9.8 (v3.1) | Critical |
| CVE-2022-41840 | Welcart eCommerce <=2.7.7 - Local File Inclusion | welcart e-commerce | 9.8 (v3.1) | Critical |
| CVE-2022-44276 | responsive filemanager Unrestricted Upload of File with Dangerous Type Vulnerability | responsive filemanager | 9.8 (v3.1) | Critical |
| CVE-2022-47615 | LearnPress Plugin < 4.2.0 - Local File Inclusion | learnpress | 9.8 (v3.1) | Critical |
| CVE-2023-26469 | Jorani unauthenticated Remote Code Execution | jorani | 9.8 (v3.1) | Critical |
| CVE-2023-5991 | Hotel Booking Lite < 4.8.5 - Arbitrary File Download & Deletion | hotel booking lite | 9.8 (v3.1) | Critical |
| CVE-2023-6623 | Essential Blocks < 4.4.3 - Local File Inclusion | essential blocks | 9.8 (v3.1) | Critical |
| CVE-2024-12209 | WP Umbrella Update Backup Restore & Monitoring <= 2.17.0 - Local File Inclusion | wp-umbrella | 9.8 (v3.1) | Critical |
| CVE-2024-32641 | Masa CMS Vulnerable to Pre-Auth RCE via JSON API | masacms | 9.8 (v3.1) | Critical |
| CVE-2024-5827 | Vanna - SQL injection | vanna-ai/vanna | 9.8 (v3.0) | Critical |
| CVE-2024-7399 | Samsung MagicINFO 9 Server Remote Code Execution (CVE-2024-7399) | magicinfo 9 server | 9.8 (v3.1) | Critical |
| CVE-2025-2294 | Kubio AI Page Builder <= 2.5.1 - Local File Inclusion | Kubio AI Page Builder | 9.8 (v3.1) | Critical |
| CVE-2025-24893 | XWiki Platform - Remote Code Execution | xwiki | 9.8 (v3.1) | Critical |
| CVE-2025-29306 | FoxCMS v.1.2.5 - Remote Code Execution | foxcms | 9.8 (v3.1) | Critical |
| CVE-2025-47445 | WordPress Eventin (Themewinter) ≤ 4.0.26 - Arbitrary File Download | eventin | 9.8 (v3.1) | Critical |
| CVE-2025-56563 | Server-Side Request Forgery | - | 9.8 (v3.1) | Critical |
| CVE-2025-6439 | WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion | WooCommerce Designer Pro | 9.8 (v3.1) | Critical |
| CVE-2025-66401 | MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL | mcp watch | 9.8 (v3.1) | Critical |
| CVE-2026-104586 | AUTOM8N (WHM/cPanel plugin) through commit 82821f7 Command Injection Vulnerability | - | 9.8 (v3.1) | Critical |
| CVE-2026-104798 | My Calendar <= 3.8.7 - Unauthenticated Privilege Escalation to 'mcs' Parameter via Reflected Shortcode Injection into 'a | My Calendar – Accessible Event Manager | 9.8 (v3.1) | Critical |
| CVE-2026-110392 | Samsung QA-Board — Unauthenticated OS command injection via output redo/tuning | QA-Board | 9.8 (v3.1) | Critical |
| CVE-2026-12227 | Visual Composer <= 45.16.0 - Unauthenticated LFI | visualcomposer | 9.8 (v3.1) | Critical |
| CVE-2026-12940 | Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoint | langflow | 9.8 (v3.1) | Critical |
| CVE-2026-30118 | scalar/astro v0.1.13 was discovered to Server-Side Request Forgery Vulnerability | - | 9.8 (v3.1) | Critical |
| CVE-2026-3296 | Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata | Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder | 9.8 (v3.1) | Critical |
| CVE-2026-35471 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in goshs | goshs | 9.8 (v3.0) | Critical |
| CVE-2026-35847 | the CheckUils.php file Arbitrary Code Execution Vulnerability | the CheckUils.php file | 9.8 (v3.1) | Critical |
| CVE-2026-37281 | the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 Command Injection Vulnerability | the /stream-to-vlc Express route in hitarth-gg Zenshin before 2.7.0 | 9.8 (v3.1) | Critical |
| CVE-2026-38428 | kestra SQL Injection Vulnerability | kestra | 9.8 (v3.1) | Critical |
| CVE-2026-39394 | CI4MS has an .env CRLF Injection via Unvalidated host Parameter in Install Controller | ci4ms | 9.8 (v3.1) | Critical |
| CVE-2026-3960 | Remote Code Execution in h2oai/h2o-3 | h2o | 9.8 (v3.1) | Critical |
| CVE-2026-46562 | Yamcs: Remote Code Execution via Mission Database algorithm override | yamcs | 9.8 (v3.1) | Critical |
| CVE-2026-53545 | Termix: Remote Code Execution via Tunnel Disconnect pkill Command Injection | Termix | 9.8 (v3.1) | Critical |
| CVE-2026-59774 | Forgejo Arbitrary File Read via Org-mode Include | Gitea | 9.8 (v3.1) | Critical |
| CVE-2026-61560 | @zereight/mcp-gitlab's unauthenticated arbitrary file read via upload_markdown enables PAT exfiltration and full accou | gitlab-mcp | 9.8 (v3.1) | Critical |
| CVE-2026-67827 | Incorrect Access Control in the HTTP API module in ZLMediaKit commit 9fd5152 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical |
| CVE-2026-75337 | Yu AI Code Mother v4.3 is vulnerable to path traversal Vulnerability | Yu AI Code Mother v4.3 is vulnerable to path traversal | 9.8 (v3.1) | Critical |
| CVE-2026-83627 | Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN <= 3.21.0 - Unauthenticated Remote Code Execution via | Hummingbird Performance – Cache & Page Speed Optimization for Core Web Vitals | Critical CSS | Minify CSS | Defer CSS Javascript | CDN | 9.8 (v3.1) | Critical |
| CVE-2026-84372 | Predis: Redis command injection and denial of service via CRLF smuggling in pipelined commands on aggregate connections | predis | 9.8 (v3.1) | Critical |
| CVE-2026-88393 | WookTeam 1.6.6 and Earlier Code Injection Vulnerability | - | 9.8 (v3.1) | Critical |
| CVE-2019-8982 | Wavemaker Studio 6.6 - Local File Inclusion/Server-Side Request Forgery | wavemarker studio | 9.6 (v3.0) | Critical |
| CVE-2026-12564 | Automation-controller: automation-controller: kubernetes service account token exfiltration via hashicorp vault credenti | Red Hat Ansible Automation Platform 2.4 for RHEL 8 | 9.6 (v3.1) | Critical |
| CVE-2026-12605 | glassfish Server-Side Request Forgery Vulnerability | glassfish | 9.6 (v3.1) | Critical |
| CVE-2026-13751 | Snowflake CLI Server-Side Request Forgery via Arbitrary URL Fetch in !source/!load | snowflake cli | 9.6 (v3.1) | Critical |
| CVE-2026-35906 | An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 OS Command Injection Vulnerability | - | 9.6 (v3.1) | Critical |
| CVE-2026-57496 | NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction | NetLicensing-MCP | 9.6 (v3.1) | Critical |
| CVE-2026-61559 | @zereight/mcp-gitlab Vulnerable to Server-Side Request Forgery | gitlab-mcp | 9.6 (v3.1) | Critical |
| CVE-2020-36856 | Nagios XI < 5.6.14 Authenticated RCE command_test.php via address | nagios xi | 9.4 (v4.0) | Critical |
| CVE-2025-6793 | Marvell QConvergeConsole Path Traversal (CVE-2025-6793) | qconvergeconsole | 9.4 (v3.0) | Critical |
| CVE-2026-39932 | OpenEMR 8.2.0 Remote Code Execution via CategoryTree eval() Injection | openemr | 9.4 (v4.0) | Critical |
| CVE-2026-40576 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in excel-mcp-server | excel-mcp-server | 9.4 (v3.1) | Critical |
| CVE-2026-58146 | Unauthorized remote code execution in T-Mobile 5G Box IDU routers | T-Mobile 5G Box IDU | 9.4 (v4.0) | Critical |
| CVE-2026-69256 | Flowise: Remote Code Execution Vulnerability in CSVAgent | flowise | 9.4 (v4.0) | Critical |
| CVE-2026-72850 | Budibase before 3.40.0 Arbitrary File Write via Path Traversal | server | 9.4 (v4.0) | Critical |
| CVE-2026-77086 | SiYuan before v3.7.4 Path Traversal via packageName | siyuan | 9.4 (v4.0) | Critical |
| CVE-2018-25357 | Dolibarr ERP CRM 7.0.3 Remote Code Execution via install/step1.php | dolibarr erp/crm | 9.3 (v4.0) | Critical |
| CVE-2019-25727 | WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download | Ad Manager WD | 9.3 (v4.0) | Critical |
| CVE-2024-27954 | WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF | Automatic | 9.3 (v3.1) | Critical |
| CVE-2025-10364 | Unauthenticated Arbitrary Command Injection in Evertz SDVN | 3080ipx-10G | 9.3 (v4.0) | Critical |
| CVE-2025-34100 | BuilderEngine Arbitrary File Upload Vulnerability and execution | CMS | 9.3 (v4.0) | Critical |
| CVE-2025-59737 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 9.3 (v4.0) | Critical |
| CVE-2025-59739 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 9.3 (v4.0) | Critical |
| CVE-2025-59740 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 9.3 (v4.0) | Critical |
| CVE-2025-59741 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 9.3 (v4.0) | Critical |
| CVE-2025-71429 | GPT-SoVITS through 20250606v2pro OS Command Injection via UVR5 vr.py | GPT-SoVITS | 9.3 (v4.0) | Critical |
| CVE-2026-101001 | Netcore NBR200V2 Web Management network_tools eval os command injection | NBR200V2 | 9.3 (v4.0) | Critical |
| CVE-2026-102240 | Netcore NAP930 Network Tools CGI network_tools eval os command injection | NAP930 | 9.3 (v4.0) | Critical |
| CVE-2026-105110 | Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter | Innbox | 9.3 (v4.0) | Critical |
| CVE-2026-107780 | Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter | skyeye | 9.3 (v4.0) | Critical |
| CVE-2026-108598 | Floci 1.1.0 before 2.2.0 RCE via API Gateway VTL Mapping Templates | floci | 9.3 (v4.0) | Critical |
| CVE-2026-108804 | TRENDnet TEW-751DR/TEW-752DRU/TEW733GR Web Management Backend pigwidgeon.cgi fwrite os command injection | TEW-751DR | 9.3 (v4.0) | Critical |
| CVE-2026-113802 | Wavlink WL-WN530BE1-A Unauthenticated OS Command Injection in ioos protocol.csp ovpn_file Handler | WL-WN530BE1-A | 9.3 (v4.0) | Critical |
| CVE-2026-23734 | XWiki Platform: Path traversal via resources parameter in ssx and jsx endpoints when using leading slash | xwiki-commons | 9.3 (v4.0) | Critical |
| CVE-2026-27174 | MajorDoMo Console Eval Unauthenticated RCE | majordomo | 9.3 (v4.0) | Critical |
| CVE-2026-34106 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in subtitles.php | language-system | 9.3 (v4.0) | Critical |
| CVE-2026-34108 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in text.php | language-system | 9.3 (v4.0) | Critical |
| CVE-2026-34109 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speech.php | language-system | 9.3 (v4.0) | Critical |
| CVE-2026-34110 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in complex_start.php | language-system | 9.3 (v4.0) | Critical |
| CVE-2026-34111 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac_text.php | language-system | 9.3 (v4.0) | Critical |
| CVE-2026-34112 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in speechmac.php | language-system | 9.3 (v4.0) | Critical |
| CVE-2026-34115 | Guardian Language-System Unauthenticated OS Command Injection via id Parameter in transcribe_amazon.php | language-system | 9.3 (v4.0) | Critical |
| CVE-2026-34415 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload | xerteonlinetoolkits | 9.3 (v4.0) | Critical |
| CVE-2026-35047 | Brave CMS has Unrestricted File Upload in BraveCMS via CKEditor Endpoint | bravecms | 9.3 (v4.0) | Critical |
| CVE-2026-41064 | AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) | avideo | 9.3 (v3.1) | Critical |
| CVE-2026-41939 | Care Everywhere Gateway 14.3.10 Hard-coded Credentials RCE via WildFly | Care Everywhere Gateway | 9.3 (v4.0) | Critical |
| CVE-2026-44257 | efw4.X: RCE via zipslip | efw4.X | 9.3 (v4.0) | Critical |
| CVE-2026-44343 | WGDashboard < 4.3.2 - Unauthenticated File Read | wgdashboard | 9.3 (v4.0) | Critical |
| CVE-2026-44402 | Voltronic Power SNMP Web Pro 1.1 Unauthenticated RCE via upload.cgi | SNMP Web Pro | 9.3 (v4.0) | Critical |
| CVE-2026-45668 | Trilium Notes : Note Import to RCE via #docName Path Traversal (Safe Import Enabled) | Trilium | 9.3 (v4.0) | Critical |
| CVE-2026-47754 | unauthenticated path traversal in Metacat 2.x | metacat | 9.3 (v3.1) | Critical |
| CVE-2026-53975 | OpenChamber 1.11.7 Unauthenticated RCE via /api/fs/exec | OpenChamber | 9.3 (v4.0) | Critical |
| CVE-2026-53976 | OpenChamber <1.13.0 - Unauthenticated Arbitrary File Read | OpenChamber | 9.3 (v4.0) | Critical |
| CVE-2026-58457 | Shenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.csp | M300 Wi-Fi Repeater | 9.3 (v4.0) | Critical |
| CVE-2026-59111 | Command Injection vulnerability in eObčanka-Identifikace | eObčanka-Identifikace | 9.3 (v3.1) | Critical |
| CVE-2026-6074 | Path traversal: '…/…//' in Intrado 911 Emergency Gateway (EGW) | 911 Emergency Gateway | 9.3 (v4.0) | Critical |
| CVE-2026-61498 | Vitec Flamingo 4.12.2 Unauthenticated OS Command Injection via gen_graphs.php | flamingo | 9.3 (v4.0) | Critical |
| CVE-2026-61511 | vBulletin 6.x - Remote Code Execution | vBulletin | 9.3 (v4.0) | Critical |
| CVE-2026-63766 | GPT-SoVITS 20250606v2pro OS Command Injection via webui.py | GPT-SoVITS | 9.3 (v4.0) | Critical |
| CVE-2026-64849 | MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirect | mlflow | 9.3 (v3.1) | Critical |
| CVE-2026-65700 | h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API | h2ogpt | 9.3 (v4.0) | Critical |
| CVE-2026-66794 | Cluster-proxy-addon: cluster-proxy-addon: unauthenticated ssrf to arbitrary managed-cluster services via public route | multicluster engine for Kubernetes 2.10 | 9.3 (v3.1) | Critical |
| CVE-2026-69110 | OpenCode Studio < 2.4.4 Unauthenticated File Read via /api/tmp and /api/music | opencode-studio | 9.3 (v4.0) | Critical |
| CVE-2026-71921 | DrayTek VigorSwitch Multiple Models Pre-Authentication OS Command Injection via setget.cgi | VigorSwitch G2540xs | 9.3 (v4.0) | Critical |
| CVE-2026-71946 | D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical |
| CVE-2026-71947 | D-Link DWR-M961 Command Injection via /boafrm/formTracerouteDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical |
| CVE-2026-71948 | D-Link DWR-M961 Command Injection via /boafrm/formDebugDiagnosticRun | DWR-M961 | 9.3 (v4.0) | Critical |
| CVE-2026-71955 | D-Link DWR-M961 Command Injection via /boafrm/formWsc | DWR-M961 | 9.3 (v4.0) | Critical |
| CVE-2026-71984 | MSI Radix AXE6600 v781521 Command Injection via urlfilter | Radix AXE6600 | 9.3 (v4.0) | Critical |
| CVE-2026-71992 | MSI Radix AXE6600 v781521 Command Injection via macfilter | Radix AXE6600 | 9.3 (v4.0) | Critical |
| CVE-2026-72710 | SPIP < 4.4.18 Remote Code Execution via editer_objet.php Job Queue Injection | SPIP | 9.3 (v4.0) | Critical |
| CVE-2026-85520 | Unauthenticated arbitrary file write leading to RCE in gmfeed PrestaShop module | Google Merchant Center Feed | 9.3 (v4.0) | Critical |
| CVE-2026-89308 | Arbitrary command execution in TrxTimeATTENDANCE | TrxTimeATTENDANCE | 9.3 (v4.0) | Critical |
| CVE-2026-96754 | orval @orval/hono before 8.29.0 Code Injection via OpenAPI Path | orval | 9.3 (v4.0) | Critical |
| CVE-2016-20101 | Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php | Issuu Panel | 9.2 (v4.0) | Critical |
| CVE-2026-110628 | Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment | kan | 9.2 (v4.0) | Critical |
| CVE-2026-56266 | Crawl4AI - Server-Side Request Forgery via Direct Crawl Endpoints | crawl4ai | 9.2 (v4.0) | Critical |
| CVE-2026-63306 | stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints | stoatchat | 9.2 (v4.0) | Critical |
| CVE-2026-65317 | Verba (goldenverba) Server-Side Request Forgery via /api/connect and Same-Origin Middleware Bypass | Verba | 9.2 (v4.0) | Critical |
| CVE-2026-65760 | Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0 | Easy Store extension for Joomla | 9.2 (v4.0) | Critical |
| CVE-2026-66914 | SEBLOD for Joomla < 3.30.0/< 4.7.0/< 6.0.1 - Path Traversal | seblod | 9.2 (v4.0) | Critical |
| CVE-2026-85614 | OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker | openpanel | 9.2 (v4.0) | Critical |
| CVE-2026-86119 | Webstudio through 0.296.0 SSRF via /cgi proxy routes | webstudio | 9.2 (v4.0) | Critical |
| CVE-2012-3152 | Oracle Forms and Reports Remote Code Execution | fusion middleware | 9.1 (v3.1) | Critical |
| CVE-2018-14916 | Loytec LGATE-902 <6.4.2 - Local File Inclusion | lgate-902 | 9.1 (v3.0) | Critical |
| CVE-2018-16716 | NCBI ToolBox - Directory Traversal | ncbi toolbox | 9.1 (v3.0) | Critical |
| CVE-2018-19365 | Wowza Streaming Engine Manager 4.7.4.01 - Directory Traversal | streaming engine | 9.1 (v3.1) | Critical |
| CVE-2021-28918 | Netmask NPM Package - Server-Side Request Forgery | netmask | 9.1 (v3.1) | Critical |
| CVE-2022-26960 | elFinder <=2.1.60 - Local File Inclusion | elfinder | 9.1 (v3.1) | Critical |
| CVE-2024-40422 | Devika v1 - Path Traversal | devika | 9.1 (v3.1) | Critical |
| CVE-2025-12999 | Eclipse Open VSX Insufficient Verification of Data Authenticity Vulnerability | Eclipse Open VSX | 9.1 (v4.0) | Critical |
| CVE-2025-55526 | n8n workflow collection Path Traversal Vulnerability | n8n workflow collection | 9.1 (v3.1) | Critical |
| CVE-2025-61318 | emlog Path Traversal Vulnerability | emlog | 9.1 (v3.1) | Critical |
| CVE-2025-65473 | easyimages2.0 Arbitrary Code Execution Vulnerability | easyimages2.0 | 9.1 (v3.1) | Critical |
| CVE-2026-105772 | Arbitrary file read and write in Google ADK TypeScript (@google/adk) FileArtifactService via path traversal in userId an | ADK TypeScript (@google/adk) | 9.1 (v4.0) | Critical |
| CVE-2026-107781 | Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById | skyeye | 9.1 (v4.0) | Critical |
| CVE-2026-12486 | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability | GV-I/O Box 4E | 9.1 (v3.1) | Critical |
| CVE-2026-12849 | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability | GV-I/O Box 4E | 9.1 (v3.1) | Critical |
| CVE-2026-12850 | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability | GV-I/O Box 4E | 9.1 (v3.1) | Critical |
| CVE-2026-12851 | GeoVision GV-I/O Box 4E libNetSetObj.so OS command injection vulnerability | GV-I/O Box 4E | 9.1 (v3.1) | Critical |
| CVE-2026-13147 | WordPress Kirki < 6.0.12 - Server-Side Request Forgery | kirki | 9.1 (v3.1) | Critical |
| CVE-2026-3141 | FormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter | FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More | 9.1 (v3.1) | Critical |
| CVE-2026-39353 | InvoicePlane: Remote Code Execution via Writable Templates Directory | InvoicePlane | 9.1 (v3.1) | Critical |
| CVE-2026-44313 | LinkWarden: Server-Side Request Forgery (SSRF) in Link Creation via fetchTitleAndHeaders Function | linkwarden | 9.1 (v3.1) | Critical |
| CVE-2026-44542 | FileBrowser Quantum: Unauthenticated Path Traversal in Public Share Delete Allows Arbitrary File Deletion | filebrowser quantum | 9.1 (v3.1) | Critical |
| CVE-2026-46621 | Yamcs: Authenticated Remote Code Execution (RCE) via Jython Algorithm Code Injection | yamcs | 9.1 (v3.1) | Critical |
| CVE-2026-52610 | reportico-web <= 8.1.0 Path Traversal Vulnerability | reportico-web <= 8.1.0 | 9.1 (v3.1) | Critical |
| CVE-2026-55511 | Yamcs: Authenticated RCE via StreamSQL aggregate-compiler column-name injection in Yamcs executeSql | yamcs | 9.1 (v3.1) | Critical |
| CVE-2026-58400 | GeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatter | core-geonetwork | 9.1 (v3.1) | Critical |
| CVE-2026-75332 | Zyplayer-Doc <=1.0.0 Server-Side Request Forgery Vulnerability | - | 9.1 (v3.1) | Critical |
| CVE-2026-79766 | Termix: OS command injection in ACME/Let's Encrypt certificate-request handler via admin-controlled domain/email | Termix | 9.1 (v3.1) | Critical |
| CVE-2008-4668 | Joomla! Image Browser 0.1.5 rc2 - Local File Inclusion | com imagebrowser | 9.0 (v2.0) | High |
| CVE-2026-102608 | ZoneMinder: Authenticated OS Command Injection via unsanitized Monitor Name in event export (download_functions.php) | zoneminder | 9.0 (v3.1) | Critical |
| CVE-2026-13603 | SSRF with API key leak in pretix-oppwa | pretix-oppwa | 9.0 (v4.0) | Critical |
| CVE-2026-34612 | Kestra: Remote Code Execution via SQL Injection | kestra | 9.0 (v3.1) | Critical |
| CVE-2026-45750 | Termix Vulnerable to Arbitrary Command Execution in File Manager | termix | 9.0 (v3.1) | Critical |
| CVE-2026-62674 | Omnigent: Shared Agent Bundle Overwrite Leads to Authenticated Runner RCE | omnigent | 9.0 (v3.1) | Critical |
| CVE-2026-69251 | Flowise RCE via TypeORM DataSource | flowise | 9.0 (v4.0) | Critical |
| CVE-2026-93697 | cPanel Arbitrary Code Execution Vulnerability | cPanel | 9.0 (v3.0) | Critical |
| CVE-2025-12060 | Keras keras.utils.get_file Utility Path Traversal Vulnerability | Keras | 8.9 (v4.0) | High |
| CVE-2026-41304 | WWBN AVideo vulnerable to RCE caused by clonesite plugin | avideo | 8.9 (v4.0) | High |
| CVE-2026-43945 | FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection | FUXA | 8.9 (v4.0) | High |
| CVE-2026-62679 | Lychee: Path traversal in SecurePathController allows authenticated arbitrary file read | Lychee | 8.9 (v4.0) | High |
| CVE-2026-73570 | zimbra collaboration suite Arbitrary Code Execution Vulnerability | zimbra collaboration suite | 8.9 (v3.1) | High |
| CVE-2014-125125 | A10 Networks AX Loadbalancer Directory Traversal | AX Series Loadbalancer | 8.8 (v4.0) | High |
| CVE-2014-5468 | Railo Remote File Include | railo | 8.8 (v3.1) | High |
| CVE-2016-6277 | NETGEAR Routers - Remote Code Execution | d6220 firmware | 8.8 (v3.1) | High |
| CVE-2017-14535 | Trixbox - 2.8.0.4 OS Command Injection | trixbox | 8.8 (v3.1) | High |
| CVE-2017-5259 | Cambium cnPilot r200/r201 Command Execution as 'root' | cnpilot r190v firmware | 8.8 (v3.0) | High |
| CVE-2017-5261 | Cambium cnPilot r200/r201 File Path Traversal | cnpilot r190v firmware | 8.8 (v3.0) | High |
| CVE-2017-6884 | Zyxel_ EMG2926 < V1.00(AAQT.4)b8 - OS Command Injection | emg2926 firmware | 8.8 (v3.1) | High |
| CVE-2018-10093 | AudioCodes 420HD - Remote Code Execution | 420hd ip phone firmware | 8.8 (v3.0) | High |
| CVE-2018-10823 | D-Link Routers - Remote Command Injection | dwr-116 firmware | 8.8 (v3.1) | High |
| CVE-2018-12613 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | 8.8 (v3.1) | High |
| CVE-2018-17553 | Navigate CMS Unauthenticated Remote Code Execution | navigate cms | 8.8 (v3.0) | High |
| CVE-2019-12169 | ATutor 2.2.4 - Directory Traversal / Remote Code Execution, | atutor | 8.8 (v3.1) | High |
| CVE-2019-12799 | Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE | shopware | 8.8 (v3.1) | High |
| CVE-2019-14530 | OpenEMR <5.0.2 - Local File Inclusion | openemr | 8.8 (v3.1) | High |
| CVE-2019-8942 | WordPress Crop-image Shell Upload | WordPress | 8.8 (v3.0) | High |
| CVE-2020-13851 | Artica Pandora FMS 7.44 - Remote Code Execution | pandora fms | 8.8 (v3.1) | High |
| CVE-2020-15874 | Command Injection | - | 8.8 (v3.1) | High |
| CVE-2020-24579 | D-Link DSL 2888a - Authentication Bypass/Remote Command Execution | dsl2888a firmware | 8.8 (v3.1) | High |
| CVE-2020-8163 | Ruby on Rails <5.0.1 - Remote Code Execution | rails | 8.8 (v3.1) | High |
| CVE-2020-8641 | Lotus Core CMS 1.0.1 - Local File Inclusion | lotus core cms | 8.8 (v3.1) | High |
| CVE-2021-37343 | Nagios XI Autodiscovery Webshell Upload | nagios xi | 8.8 (v3.1) | High |
| CVE-2022-34876 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High |
| CVE-2022-34877 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High |
| CVE-2022-34878 | VICIdial Multiple Authenticated SQLi | vicidial | 8.8 (v3.1) | High |
| CVE-2022-51022 | YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint | YiShaAdmin | 8.8 (v4.0) | High |
| CVE-2023-39108 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High |
| CVE-2023-39109 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High |
| CVE-2023-39110 | rConfig 3.9.4 - Server-Side Request Forgery | rconfig | 8.8 (v3.1) | High |
| CVE-2023-49084 | Cacti RCE via SQLi in pollers.php | cacti | 8.8 (v3.1) | High |
| CVE-2023-49085 | Cacti RCE via SQLi in pollers.php | cacti | 8.8 (v3.1) | High |
| CVE-2024-37032 | Ollama Model Registry Path Traversal RCE | ollama | 8.8 (v3.1) | High |
| CVE-2024-7340 | W&B Weave Server - Remote Arbitrary File Leak | - | 8.8 (v3.1) | High |
| CVE-2025-10706 | Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation | ClassifiedPro - reCommerce WordPress Theme | 8.8 (v3.1) | High |
| CVE-2025-51457 | D-Link DAP-2610 up to 2.06B08r099 Command Injection Vulnerability | D-Link DAP-2610 up to 2.06B08r099 | 8.8 (v3.1) | High |
| CVE-2025-65471 | easyimages2.0 Arbitrary Code Execution Vulnerability | easyimages2.0 | 8.8 (v3.1) | High |
| CVE-2025-68705 | RustFS Path Traversal Vulnerability | rustfs | 8.8 (v4.0) | High |
| CVE-2026-100391 | MediaFlow Proxy through 2.4.9 Server-Side Request Forgery via Incomplete Validation | mediaflow-proxy | 8.8 (v4.0) | High |
| CVE-2026-104464 | YesWiki before 4.6.7 SSRF via Bazar abonnements sync actor parameter | yeswiki | 8.8 (v4.0) | High |
| CVE-2026-110908 | pfSense-pkg-frr Command Injection Vulnerability | pfSense-pkg-frr | 8.8 (v3.1) | High |
| CVE-2026-17623 | Langflow is affected OS Command Injection in Model Context Protocol features | langflow | 8.8 (v3.1) | High |
| CVE-2026-17625 | Langflow is affected by OS Command Injection in Model Context Protocol features | langflow | 8.8 (v3.1) | High |
| CVE-2026-34197 | Apache ActiveMQ Jolokia Remote Code Execution (CVE-2026-34197) | activemq | 8.8 (v3.1) | High |
| CVE-2026-34413 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload | xerteonlinetoolkits | 8.8 (v4.0) | High |
| CVE-2026-35196 | Chamilo LMS has OS Command Injection via export_all_certificates action | chamilo lms | 8.8 (v3.1) | High |
| CVE-2026-40611 | Lego: Arbitrary File Write via Path Traversal in Webroot HTTP-01 Provider | lego | 8.8 (v3.1) | High |
| CVE-2026-42605 | AzuraCast: Path Traversal in currentDirectory Parameter Enables Remote Code Execution via Media Upload | azuracast | 8.8 (v3.1) | High |
| CVE-2026-50186 | 4gaBoards: Path Traversal leading to Arbitrary File Read and Deletion in Board Export | 4gaBoards | 8.8 (v3.1) | High |
| CVE-2026-52483 | OS Command Injection | - | 8.8 (v3.1) | High |
| CVE-2026-52484 | MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 Arbitrary Code Execution Vulnerability | - | 8.8 (v3.1) | High |
| CVE-2026-54149 | MaxKB MCP tool import validation bypass allows post-authentication remote code execution | MaxKB | 8.8 (v3.1) | High |
| CVE-2026-57143 | PraisonAI: Server-Side Request Forgery (SSRF) in SearxNG / search_web tools via attacker-controlled searxng_url paramete | praisonaiagents | 8.8 (v3.1) | High |
| CVE-2026-57296 | Jenkins External Workspace Manager Plugin Arbitrary Code Execution Vulnerability | Jenkins External Workspace Manager Plugin | 8.8 (v3.1) | High |
| CVE-2026-59734 | Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution | coolify | 8.8 (v3.1) | High |
| CVE-2026-61525 | Zammad: Arbitrary File Deletion via Unvalidated Session Identifier in Long Polling Controller | zammad | 8.8 (v4.0) | High |
| CVE-2026-65660 | Microsoft SharePoint Server Remote Code Execution Vulnerability | sharepoint server | 8.8 (v3.1) | High |
| CVE-2026-72875 | Dokploy: Remote Code Execution (RCE) via Command Injection in settings.readTraefikFile | dokploy | 8.8 (v3.1) | High |
| CVE-2026-76842 | Mercado Pago Node.js SDK through 3.4.0 Path Injection via Unencoded Identifiers in Payment Clients | mercadopago | 8.8 (v4.0) | High |
| CVE-2026-77601 | OpenC3 COSMOS: Authenticated OS command injection via the pypi_url setting | cosmos | 8.8 (v3.1) | High |
| CVE-2026-82804 | Apache DolphinScheduler: Command Injection in the Alert Script Plugin | Apache DolphinScheduler | 8.8 (v3.1) | High |
| CVE-2026-84317 | Nginx UI: MCP nginx_config_add skips config directive validation → authenticated nginx directive injection (RCE on the o | nginx-ui | 8.8 (v3.1) | High |
| CVE-2026-84318 | Nginx UI: MCP nginx_config_add Bypasses Directive Validation — Authenticated RCE | nginx-ui | 8.8 (v3.1) | High |
| CVE-2026-85731 | oras-go: Arbitrary file write outside file.Store root via symlink-chain bypass in tar extraction (pushDir) | oras-go | 8.8 (v3.1) | High |
| CVE-2026-87927 | MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher | MaxSite CMS | 8.8 (v4.0) | High |
| CVE-2026-92566 | DataGear through 6.0.0 Unauthenticated SSRF via HTTP Dataset Preview | datagear | 8.8 (v4.0) | High |
| CVE-2005-10004 | Cacti graph_view.php Remote Command Execution | cacti | 8.7 (v4.0) | High |
| CVE-2009-10005 | ContentKeeper Web Appliance mimencode File Access | Web Appliance | 8.7 (v4.0) | High |
| CVE-2011-10009 | S40 0.4.2 CMS Directory Traversal Vulnerability | S40 CMS | 8.7 (v4.0) | High |
| CVE-2014-125130 | CodeArt Google MP3 Audio Player 1.0.11 Arbitrary File Read via direct_download.php | CodeArt Google MP3 Audio Player | 8.7 (v4.0) | High |
| CVE-2014-125133 | NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php | NativeChurch | 8.7 (v4.0) | High |
| CVE-2014-125134 | ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php | ChurcHope | 8.7 (v4.0) | High |
| CVE-2015-10145 | Gargoyle 1.5.x Authenticated OS Command Execution via run_commands.sh | gargoyle | 8.7 (v4.0) | High |
| CVE-2015-20124 | Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php | Aspose Importer & Exporter | 8.7 (v4.0) | High |
| CVE-2015-20125 | Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php | Aspose PDF Exporter | 8.7 (v4.0) | High |
| CVE-2016-20103 | Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php | Cherry Plugin | 8.7 (v4.0) | High |
| CVE-2016-20104 | EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php | nano NXT | 8.7 (v4.0) | High |
| CVE-2017-20248 | WordPress Plugin Apptha Slider Gallery 1.0 Path Traversal File Download | Apptha Slider Gallery | 8.7 (v4.0) | High |
| CVE-2017-20250 | WordPress Plugin Mac Photo Gallery 3.0 Arbitrary File Download | Mac Photo Gallery | 8.7 (v4.0) | High |
| CVE-2017-20284 | Caucho Resin resin-doc Unauthenticated Path Traversal via jndi-appconfig Servlet | Resin | 8.7 (v4.0) | High |
| CVE-2017-20287 | Javo Spot WordPress Theme < 3.0.0 Path Traversal via admin-ajax.php fn Parameter | Javo Spot | 8.7 (v4.0) | High |
| CVE-2018-25113 | Dicoogle PACS Web Server Directory Traversal | PACS Web Server | 8.7 (v4.0) | High |
| CVE-2018-25374 | Softneta MedDream PACS Server Premium 6.7.1.1 Directory Traversal | MedDream PACS Server Premium | 8.7 (v4.0) | High |
| CVE-2018-25438 | Intermesh Group-Office < 3.5.5 Path Traversal via compress.php | Group-Office | 8.7 (v4.0) | High |
| CVE-2019-25779 | WooThemes Diarise 1.5.9 Local File Disclosure via download.php | Diarise | 8.7 (v4.0) | High |
| CVE-2020-36939 | Cassandra Web File Read Vulnerability | Cassandra Web | 8.7 (v4.0) | High |
| CVE-2020-37214 | Voyager 1.3.0 - Directory Traversal | Voyager | 8.7 (v4.0) | High |
| CVE-2020-37278 | Weaver e-Bridge Unauthenticated Arbitrary File Read via saveYZJFile | e-Bridge | 8.7 (v4.0) | High |
| CVE-2021-4463 | Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download | BEMS API | 8.7 (v4.0) | High |
| CVE-2021-47943 | TextPattern CMS 4.8.7 Remote Code Execution via File Upload | TextPattern CMS | 8.7 (v4.0) | High |
| CVE-2021-48013 | Weaver E-cology 8.0 Unauthenticated Path Traversal via ln.FileDownload | E-cology | 8.7 (v4.0) | High |
| CVE-2021-48015 | JeeWMS Path Traversal via showOrDownByurl.do | JeeWMS | 8.7 (v4.0) | High |
| CVE-2021-48017 | OrbiTeam BSCW Server < 5.2.5 / 7.4.4 Path Traversal via bscw.cgi | BSCW Server | 8.7 (v4.0) | High |
| CVE-2022-50944 | Aero CMS 0.0.1 PHP Code Injection via posts.php | Aero CMS | 8.7 (v4.0) | High |
| CVE-2022-51024 | Kavita < 0.5.4.1 Unauthenticated Path Traversal via cover-upload Endpoint | Kavita | 8.7 (v4.0) | High |
| CVE-2023-54402 | iDocView SSRF via /doc/upload Endpoint Hardcoded Token | iDocView | 8.7 (v4.0) | High |
| CVE-2023-54403 | Yonyou U8 CRM Arbitrary File Read via getemaildata.php | U8 CRM | 8.7 (v4.0) | High |
| CVE-2024-11303 | Korenix JetPort 5601v3 - Path Traversal | JetPort 5601 | 8.7 (v4.0) | High |
| CVE-2024-13991 | Huijietong Cloud Video Platform fileDownload Arbitrary File Read | Cloud Video Platform | 8.7 (v4.0) | High |
| CVE-2024-26291 | Avid NEXIS Agent - Arbitrary File Read | nexis | 8.7 (v4.0) | High |
| CVE-2024-58387 | Inspur HCM Cloud Arbitrary File Read via file/download Endpoint | Haiyue HCM Cloud | 8.7 (v4.0) | High |
| CVE-2024-58388 | Sharp Multifunction Printers Local File Inclusion via installed_emanual_down.html | Multiple Multifunction Printers | 8.7 (v4.0) | High |
| CVE-2024-58396 | YouDataSum CPAS Audit Management System V4 Path Traversal via downPlugs fileId | CPAS Audit Management System | 8.7 (v4.0) | High |
| CVE-2025-34031 | Moodle Jmol Filter 6.1 - Local File Inclusion | jmol | 8.7 (v4.0) | High |
| CVE-2025-34115 | OP5 Monitor <= 7.1.9 Authenticated Command Execution via command_test.php | OP5 Monitor | 8.7 (v4.0) | High |
| CVE-2025-34118 | Linknat Vos Manager Traversal | VOS Manager | 8.7 (v4.0) | High |
| CVE-2025-34126 | RIPS Scanner Directory Traversal | RIPS Scanner | 8.7 (v4.0) | High |
| CVE-2025-34311 | IPFire < v2.29 Command Injection via Proxy Report Creation | ipfire | 8.7 (v4.0) | High |
| CVE-2025-34331 | AudioCodes Fax/IVR Appliance <= 2.6.23 Unauthenticated File Read via download.php | fax server | 8.7 (v4.0) | High |
| CVE-2025-34334 | AudioCodes Fax/IVR Appliance <= 2.6.23 Authenticated Command Injection via TestFax.php & LPE | fax server | 8.7 (v4.0) | High |
| CVE-2025-34350 | UnForm Server < 10.1.15 Doc Flow Unauthenticated File Read | UnForm Server | 8.7 (v4.0) | High |
| CVE-2026-10108 | xiaomusic 0.5.7 Path Traversal via GET /music endpoint | xiaomusic | 8.7 (v4.0) | High |
| CVE-2026-105123 | W (wcms) through 3.18.0 RCE and Arbitrary File Write via Media Upload API | wcms | 8.7 (v4.0) | High |
| CVE-2026-109308 | Craft CMS 4.0.0 before 4.18.7 and 5.0.0 before 5.10.14 RCE via actionCacheUpdates Behavior Injection | cms | 8.7 (v4.0) | High |
| CVE-2026-110115 | Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream | Digital-Infrastructure | 8.7 (v4.0) | High |
| CVE-2026-112904 | Vvveb: Path Traversal in nextRestore() and nextBackup() | Vvveb | 8.7 (v3.1) | High |
| CVE-2026-116009 | Camaleon CMS before 2.9.3 Path Traversal RCE via Media crop_url Action | camaleon-cms | 8.7 (v4.0) | High |
| CVE-2026-116171 | SiYuan 3.5.4 before 3.8.7 Sensitive Path Bypass via Windows Extended-Length Prefix | siyuan | 8.7 (v4.0) | High |
| CVE-2026-17524 | zip-lib Path Traversal Vulnerability | zip-lib | 8.7 (v4.0) | High |
| CVE-2026-25559 | OpenBullet2 0.3.2 Path Traversal via Wordlist Endpoint | openbullet2 | 8.7 (v4.0) | High |
| CVE-2026-25855 | OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Upload | openbullet2 | 8.7 (v4.0) | High |
| CVE-2026-25856 | OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interface | openbullet2 | 8.7 (v4.0) | High |
| CVE-2026-34228 | Emlog: CSRF in Backend Upgrade Interface Leading to Arbitrary Remote SQL Execution and Arbitrary File Write | emlog | 8.7 (v4.0) | High |
| CVE-2026-34367 | InvoiceShelf: SSRF in Invoice PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.7 (v3.1) | High |
| CVE-2026-34735 | Hytale Modding Vulnerable to Remote Code Execution via File Upload Bypass in FileController | wiki | 8.7 (v4.0) | High |
| CVE-2026-34791 | Endian Firewall /cgi-bin/logs_proxy.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High |
| CVE-2026-34792 | Endian Firewall /cgi-bin/logs_clamav.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High |
| CVE-2026-34793 | Endian Firewall /cgi-bin/logs_firewall.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High |
| CVE-2026-34794 | Endian Firewall /cgi-bin/logs_ids.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High |
| CVE-2026-34795 | Endian Firewall /cgi-bin/logs_log.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High |
| CVE-2026-34796 | Endian Firewall /cgi-bin/logs_openvpn.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High |
| CVE-2026-34797 | Endian Firewall /cgi-bin/logs_smtp.cgi DATE Perl Command Injection | firewall community | 8.7 (v4.0) | High |
| CVE-2026-41934 | Vvveb < 1.0.8.2 Authenticated RCE via Code Editor | Vvveb | 8.7 (v4.0) | High |
| CVE-2026-47659 | Pathling has path traversal in $import-pnp manifest that enables read-capable SSRF via /jobs/{jobId}/{filename} | pathling | 8.7 (v4.0) | High |
| CVE-2026-47661 | Pathling has path traversal in $result endpoint that allows arbitrary warehouse file read | pathling | 8.7 (v4.0) | High |
| CVE-2026-50053 | Zimbra Collaboration Suite RestFilter Request Attribute Override via Unauthenticated URL Parameters | Zimbra Collaboration Suite | 8.7 (v3.1) | High |
| CVE-2026-55094 | Taskcluster: Unauthenticated remote code execution in web-server via GraphQL filter argument (sift $where) | taskcluster | 8.7 (v4.0) | High |
| CVE-2026-57855 | Cockpit CMS Missing Authorization in Bucket File Storage API | Cockpit CMS | 8.7 (v4.0) | High |
| CVE-2026-64837 | ICEcoder through 8.1 OS Command Injection via lib/properties.php | ICEcoder | 8.7 (v4.0) | High |
| CVE-2026-64838 | ICEcoder through 8.1 Path Traversal via oldFileName Parameter | ICEcoder | 8.7 (v4.0) | High |
| CVE-2026-65694 | Microweber CMS <= 2.0.20 - Unauthenticated Arbitrary File Read | microweber | 8.7 (v4.0) | High |
| CVE-2026-65759 | Joomla Extension - joomshaper.com - unauthenticated payment/order forgery in Easy Store extension 1.0.0-2.0.1 | Easy Store extension for Joomla | 8.7 (v4.0) | High |
| CVE-2026-65919 | Meshery < 1.0.57 Unauthenticated Arbitrary File Read via fileView and fileDownload | meshery | 8.7 (v4.0) | High |
| CVE-2026-67200 | Perspective 5.0.0 Path Traversal via cwd_static_file_handler | perspective | 8.7 (v4.0) | High |
| CVE-2026-67206 | Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload | wolfcms | 8.7 (v4.0) | High |
| CVE-2026-67281 | Unauthenticated file read in Mikrotik RouterOS | routeros | 8.7 (v4.0) | High |
| CVE-2026-69089 | Grav CMS before 2.0.11 Path Traversal via watermark | grav | 8.7 (v4.0) | High |
| CVE-2026-69095 | OpenWrt luci-app-bmx7 Path Traversal via bmx7-info | luci | 8.7 (v4.0) | High |
| CVE-2026-75111 | Evidently UI Path Traversal via Dataset Materialization Filename | evidently | 8.7 (v4.0) | High |
| CVE-2026-75482 | SWE-agent Trajectory Inspector Path Traversal File Disclosure | SWE-agent | 8.7 (v4.0) | High |
| CVE-2026-7551 | HKUDS OpenHarness Remote Command Execution via /bridge Slash Command | openharness | 8.7 (v4.0) | High |
| CVE-2026-76060 | OS Command Injection in PayRange API | Zoneminder | 8.7 (v4.0) | High |
| CVE-2026-76836 | AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass | AzuraCast | 8.7 (v4.0) | High |
| CVE-2026-7807 | SmarterTools SmarterMail < Build 9560 Server Local File Inclusion via the /api/v1/report/summary/{type} API | smartermail | 8.7 (v4.0) | High |
| CVE-2026-79756 | Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform | nuclio | 8.7 (v4.0) | High |
| CVE-2026-81093 | Apify Actors MCP Server before 0.9.12 Server-Side Request Forgery via get-html-skeleton | actors-mcp-server | 8.7 (v4.0) | High |
| CVE-2026-82270 | Portkey AI Gateway Server-Side Request Forgery via /v1/proxy/* | gateway | 8.7 (v4.0) | High |
| CVE-2026-82638 | jina-ai reader Server-Side Request Forgery via disabled private-address guard | reader | 8.7 (v4.0) | High |
| CVE-2026-85608 | Douyin_TikTok_Download_API 4.1.2 SSRF via url parameter | Douyin TikTok Download API | 8.7 (v4.0) | High |
| CVE-2026-85610 | OpenPanel before 2.3.0 Remote Code Execution via chart formulas | openpanel | 8.7 (v4.0) | High |
| CVE-2026-85612 | OpenPanel before 2.3.0 SSRF via favicon and og endpoints | openpanel | 8.7 (v4.0) | High |
| CVE-2026-85673 | LLaMA-Factory SSRF Guard Bypass via Redirect and DNS Rebinding | LlamaFactory | 8.7 (v4.0) | High |
| CVE-2026-85685 | AgentScope through 2.0.7.post1 Arbitrary Directory Copy via add_skill | agentscope | 8.7 (v4.0) | High |
| CVE-2026-89250 | WWBN AVideo Unauthenticated File Read via getRecordedFile.php | AVideo | 8.7 (v4.0) | High |
| CVE-2026-91771 | Weights & Biases wandb before 0.29.0 Path Traversal via File Download | wandb | 8.7 (v4.0) | High |
| CVE-2026-91989 | atomic-agents-stack before 1.1.0 Path Traversal via dashboard serve.py | atomic-agents-stack | 8.7 (v4.0) | High |
| CVE-2026-92791 | Uber Kraken through 0.1.29 Path Traversal via tag parameter | kraken | 8.7 (v4.0) | High |
| CVE-2026-9506 | Path Traversal Vulnerability in Bagisto | Bagisto | 8.7 (v4.0) | High |
| CVE-2015-4694 | WordPress Zip Attachments <= 1.1.4 - Arbitrary File Retrieval | zip attachments | 8.6 (v3.0) | High |
| CVE-2018-16288 | LG SuperSign EZ CMS 2.5 - Local File Inclusion | supersign cms | 8.6 (v3.0) | High |
| CVE-2021-32820 | Express-handlebars - Local File Inclusion | express handlebars | 8.6 (v3.1) | High |
| CVE-2022-24900 | Piano LED Visualizer 1.3 - Local File Inclusion | piano led visualizer | 8.6 (v3.1) | High |
| CVE-2024-20353 | adaptive security appliance software Denial of Service Vulnerability | adaptive security appliance software | 8.6 (v3.1) | High |
| CVE-2024-34470 | HSC Mailinspector 5.2.17-3 through 5.2.18 - Local File Inclusion | mailinspector | 8.6 (v3.1) | High |
| CVE-2025-2558 | WordPress The Wound Theme <= 0.0.1 - Local File Inclusion | the wound | 8.6 (v3.1) | High |
| CVE-2025-68455 | Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior | craft cms | 8.6 (v4.0) | High |
| CVE-2026-100372 | ClipBucket v5 before 5.5.3-#197 Path Traversal via template_editor.php | clipbucket-v5 | 8.6 (v4.0) | High |
| CVE-2026-109108 | Wavlink WL-WN530BE1-A uploadVpn.cgi popen os command injection | WL-WN530BE1-A | 8.6 (v4.0) | High |
| CVE-2026-109286 | Open WebUI 0.7.0 before 0.11.4 Session Token Theft via SyncStatsModal | open-webui | 8.6 (v4.0) | High |
| CVE-2026-113390 | DrayTek Vigor2960 CGI mainfunction.cgi sub_182B0 os command injection | Vigor2960 | 8.6 (v4.0) | High |
| CVE-2026-113506 | aaPanel File Manager common.py ExecShell os command injection | aaPanel | 8.6 (v4.0) | High |
| CVE-2026-23698 | Vtiger CRM 8.4.0 Authenticated RCE via Module Import File Upload | Vtiger CRM | 8.6 (v4.0) | High |
| CVE-2026-30958 | OneUptime < 10.0.21 - Path Traversal | oneuptime | 8.6 (v3.1) | High |
| CVE-2026-34160 | Chamilo LMS: Unauthenticated SSRF via PENS Plugin allows attacker to probe internal network and reach cloud metadata ser | chamilo lms | 8.6 (v3.1) | High |
| CVE-2026-34577 | Postiz: Unauthenticated Full-Read SSRF via /public/stream Endpoint with Trivially Bypassable Extension Check | postiz | 8.6 (v3.1) | High |
| CVE-2026-40187 | Authenticated RCE via Malicious eTemplate Upload in EGroupware | egroupware | 8.6 (v4.0) | High |
| CVE-2026-41690 | Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters | i18next-http-middleware | 8.6 (v3.1) | High |
| CVE-2026-42785 | OpenKM 6.3.12 Remote Code Execution via Administrative Scripting | OpenKM Community Edition | 8.6 (v4.0) | High |
| CVE-2026-46491 | SimpleSAMLphp casserver FileSystemTicketStore path traversal allows out-of-ticket-directory read/unserialize and conditi | simplesamlphp-module-casserver | 8.6 (v3.1) | High |
| CVE-2026-53804 | OTRS Community Edition OS Command Injection via PGP Configuration | OTRS Community Edition | 8.6 (v4.0) | High |
| CVE-2026-54650 | openhole-server vulnerable to path traversal via URL-decoded request path | openhole | 8.6 (v3.1) | High |
| CVE-2026-54710 | FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) | freepbx | 8.6 (v4.0) | High |
| CVE-2026-56703 | Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTO | adminer | 8.6 (v4.0) | High |
| CVE-2026-5917 | libgit2 Shell Command Injection via ssh_libssh2 Backend | libgit2 | 8.6 (v4.0) | High |
| CVE-2026-67599 | ClearOS 7.9 OS Command Injection via Log Viewer filter parameter | ClearOS | 8.6 (v4.0) | High |
| CVE-2026-67608 | Telenia TVox 26.5.3 OS Command Injection via action_audio.php | TVox | 8.6 (v4.0) | High |
| CVE-2026-71908 | DrayTek VigorAP Multiple Models OS Command Injection via mesh_start_speed_test | VigorAP 918R | 8.6 (v4.0) | High |
| CVE-2026-71913 | DrayTek VigorAP Multiple Models OS Command Injection via upload_settings.cgi | VigorAP 918R | 8.6 (v4.0) | High |
| CVE-2026-71918 | DrayTek VigorSwitch Multiple Models OS Command Injection via webBackupAction | VigorSwitch G2540xs | 8.6 (v4.0) | High |
| CVE-2026-71919 | DrayTek VigorSwitch Multiple Models OS Command Injection via sysreboot | VigorSwitch G2540xs | 8.6 (v4.0) | High |
| CVE-2026-71931 | DrayTek VigorSwitch Multiple Models OS Command Injection via tftp_upgrade | VigorSwitch G2540xs | 8.6 (v4.0) | High |
| CVE-2026-7412 | Eclipse BaSyx SSRF Vulnerability | Eclipse BaSyx | 8.6 (v3.1) | High |
| CVE-2026-75123 | PLANET GS-4210-16P2S Command Injection via dispatcher.cgi web_smtp_test_post | PLANET GS-4210-16P2S V3 | 8.6 (v4.0) | High |
| CVE-2026-77581 | BentoPDF: SSRF in cors-proxy-worker.js via DNS-based hostname allowlist bypass | bentopdf | 8.6 (v3.1) | High |
| CVE-2026-80214 | LibreNMS Virtualisation Discovery Module RCE | librenms | 8.6 (v4.0) | High |
| CVE-2026-81889 | elFinder: SSRF protection bypass via DNS rebinding in the fsock_get_contents() fallback | elFinder | 8.6 (v3.1) | High |
| CVE-2026-82692 | D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection | DNS-340L | 8.6 (v4.0) | High |
| CVE-2026-86733 | Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore | snipe-it | 8.6 (v4.0) | High |
| CVE-2015-1489 | Symantec Endpoint Protection Manager Authentication Bypass and Code Execution | endpoint protection manager | 8.5 (v2.0) | High |
| CVE-2015-2996 | SysAid Help Desk Arbitrary File Download | sysaid | 8.5 (v2.0) | High |
| CVE-2025-34023 | Karel IP Phone IP1211 Web Management Panel - Local File Inclusion | Karel IP Phone IP1211 | 8.5 (v4.0) | High |
| CVE-2025-34332 | AudioCodes Fax/IVR Appliance <= 2.6.23 Insecure Service Control Scripts LPE | fax server | 8.5 (v4.0) | High |
| CVE-2025-34333 | AudioCodes Fax/IVR Appliance <= 2.6.23 World-Writable Webroot LPE | fax server | 8.5 (v4.0) | High |
| CVE-2026-12195 | vesta Arbitrary Code Execution Vulnerability | vesta | 8.5 (v4.0) | High |
| CVE-2026-22244 | OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE | openmetadata | 8.5 (v4.0) | High |
| CVE-2026-44881 | Portainer: Arbitrary File Read via Git Symlink Injection in Stack Auto-Update | portainer | 8.5 (v4.0) | High |
| CVE-2026-56663 | AutoGPT: SSRF-to-RCE Chain in SendWebRequestBlock via IP validation bypass and internal pg-meta access | AutoGPT | 8.5 (v3.1) | High |
| CVE-2026-57126 | praisonaiagents: SSRF guard validates literal IPs only and never resolves DNS | PraisonAI | 8.5 (v3.1) | High |
| CVE-2026-61640 | Wallos: SSRF via OIDC Token/UserInfo URL Configuration | Wallos | 8.5 (v4.0) | High |
| CVE-2026-67424 | Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation | flyto-core | 8.5 (v3.1) | High |
| CVE-2026-69250 | Flowise: Unauthenticated OAuth2 Refresh Enables Non-Blind SSRF and Secret Exfiltration | flowise | 8.5 (v4.0) | High |
| CVE-2026-73079 | Sub2API: Path traversal in the Responses subpath routes lets an authenticated tenant relay requests to arbitrary upstrea | sub2api | 8.5 (v3.1) | High |
| CVE-2026-82690 | D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection | DNS-327L | 8.5 (v4.0) | High |
| CVE-2026-85222 | D-Link DNS-340L Add-On Center addon_center.cgi os command injection | DNS-340L | 8.5 (v4.0) | High |
| CVE-2026-85224 | D-Link DNS-320 ShareCenter File Sharing file_sharing.cgi os command injection | DNS-320 ShareCenter | 8.5 (v4.0) | High |
| CVE-2026-92397 | Ruijie RG-EW3000GX configChange unifyframe-sgi.elf cc_set os command injection | RG-EW3000GX | 8.5 (v4.0) | High |
| CVE-2026-110255 | Dockhand before 1.0.43 SSRF via /api/templates/compose Endpoint | dockhand | 8.4 (v4.0) | High |
| CVE-2026-54507 | Vvveb oEmbedProxy vulnerable to server-side request forgery | Vvveb | 8.4 (v4.0) | High |
| CVE-2026-72855 | Budibase before 3.40.0 DNS Rebinding SSRF via OpenAPI and REST | server | 8.4 (v4.0) | High |
| CVE-2025-30005 | Xorcom CompletePBX Arbitrary File Read and Deletion via systemDataFileName | completepbx | 8.3 (v3.1) | High |
| CVE-2026-104458 | YesWiki before 4.6.7 SSRF Guard Bypass via IPv6 Transition Addresses | yeswiki | 8.3 (v4.0) | High |
| CVE-2026-31939 | Path Traversal (Arbitrary File Delete) in Chamilo LMS | chamilo lms | 8.3 (v3.1) | High |
| CVE-2026-34428 | Vvveb < 1.0.8.1 SSRF via oEmbedProxy | Vvveb | 8.3 (v4.0) | High |
| CVE-2026-46711 | Soft Machine: Unauthenticated workspace API exposes arbitrary file read & directory exfiltration to any peer on the Fly | security | 8.3 (v3.1) | High |
| CVE-2026-52769 | YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub Signature.keyId | yeswiki | 8.3 (v3.1) | High |
| CVE-2026-76844 | webpack-dev-middleware Path Traversal via Offset Slice on a Non-Slash-Terminated publicPath | zlib | 8.3 (v4.0) | High |
| CVE-2024-40348 | Bazarr < 1.4.3 - Arbitrary File Read | bazarr | 8.2 (v3.1) | High |
| CVE-2025-44137 | MapTiler Tileserver-php v2.0 - Unauthenticated File Read | tileserver php | 8.2 (v3.1) | High |
| CVE-2025-44177 | White Star Software Protop 4.4.2-2024-11-27 - Local File Inclusion (LFI) | protop | 8.2 (v3.1) | High |
| CVE-2026-111915 | Yank Note before 3.93.1 Path Traversal via /api/help Endpoint | Yank Note | 8.2 (v4.0) | High |
| CVE-2026-116192 | rclone from 1.37 before 1.74.2 SSRF via –rc-serve scheme-relative remote roots | rclone | 8.2 (v4.0) | High |
| CVE-2026-16268 | Newsletters < 4.16 - Unauthenticated Server-Side Request Forgery via SNS Bounce Handler | Newsletters | 8.2 (v3.1) | High |
| CVE-2026-23482 | Blinko < 1.8.4 - Path Traversal | blinko | 8.2 (v4.0) | High |
| CVE-2026-34151 | XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+ | xwiki-platform | 8.2 (v4.0) | High |
| CVE-2026-39363 | Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket | vite | 8.2 (v4.0) | High |
| CVE-2026-39364 | Vite Dev Server - Directory Traversal | vite | 8.2 (v4.0) | High |
| CVE-2026-40075 | OpenMRS Core arbitrary file read via path traversal in ModuleResourcesServlet | openmrs | 8.2 (v4.0) | High |
| CVE-2026-42564 | jotty.page < 1.22.0 - Path Traversal | jotty | 8.2 (v3.1) | High |
| CVE-2026-43910 | Appium java-client Allows Network Pivot via Unvalidated directConnect Redirect in AppiumCommandExecutor | java-client | 8.2 (v3.1) | High |
| CVE-2026-48126 | Algernon: Host header path traversal in –domain mode reads files and runs Lua from parent dir | algernon | 8.2 (v3.1) | High |
| CVE-2026-53571 | Vite: server.fs.deny bypass on Windows alternate paths | vite | 8.2 (v4.0) | High |
| CVE-2026-54691 | datamodel-code-generator vulnerable to SSRF via –url: no host/IP validation, follows redirects | datamodel-code-generator | 8.2 (v3.1) | High |
| CVE-2026-58467 | Cockpit CMS <= 2.14.0 - Path Traversal / Local File Inclusion | cockpit | 8.2 (v4.0) | High |
| CVE-2026-73658 | Trigger.dev: Cross-tenant object store read and write via URL path traversal | trigger.dev | 8.2 (v3.1) | High |
| CVE-2026-74907 | Grav before 2.0.15 Path Traversal via plugin-asset-map.php | grav | 8.2 (v4.0) | High |
| CVE-2026-77348 | Wallos incomplete fix for CVE-2026-33407: unauthenticated httpoxy SSRF still reachable via `endpoints/payments/search.ph | Wallos | 8.2 (v3.1) | High |
| CVE-2026-82262 | Logto Server-Side Request Forgery via webhook test endpoint | logto | 8.2 (v4.0) | High |
| CVE-2016-3081 | Apache Struts Dynamic Method Invocation Remote Code Execution | agile controller-campus firmware | 8.1 (v3.1) | High |
| CVE-2017-12615 | Apache Tomcat < 9.0.1 (Beta) / < 8.5.23 / < 8.0.47 / < 7.0.8 - JSP Upload Bypass / Remote Code Execution (1) | tomcat | 8.1 (v3.1) | High |
| CVE-2018-11776 | Apache Struts2 S2-057 - Remote Code Execution | struts | 8.1 (v3.1) | High |
| CVE-2021-45841 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 8.1 (v3.1) | High |
| CVE-2024-30188 | Apache DolphinScheduler >= 3.1.0, < 3.2.2 Resource File Read And Write | dolphinscheduler | 8.1 (v3.1) | High |
| CVE-2025-48157 | WordPress Formality Plugin <= 1.5.9 - Local File Inclusion | Formality | 8.1 (v3.1) | High |
| CVE-2025-9990 | WordPress Helpdesk Integration <= 5.8.10 - Unauthenticated Local File Inclusion | WordPress Helpdesk Integration | 8.1 (v3.1) | High |
| CVE-2026-19303 | Langflow is vulnerable to arbitrary file write and arbitrary file deletion due to unvalidated paths in file-processing c | langflow | 8.1 (v3.1) | High |
| CVE-2026-33236 | NLTK has a Downloader Path Traversal Vulnerability (AFO) - Arbitrary File Overwrite | nltk | 8.1 (v3.1) | High |
| CVE-2026-34365 | InvoiceShelf: SSRF in Estimate PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.1 (v3.1) | High |
| CVE-2026-34366 | InvoiceShelf: SSRF in Payment Receipt PDF Rendering via Unsanitised HTML in Notes Field | invoiceshelf | 8.1 (v3.1) | High |
| CVE-2026-42269 | countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion | countly-server | 8.1 (v3.1) | High |
| CVE-2026-46402 | Microsoft UFO uses untrusted task_name in log paths, allowing authenticated path traversal and log file creation outside | UFO | 8.1 (v3.1) | High |
| CVE-2026-46484 | Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/user | headplane | 8.1 (v3.1) | High |
| CVE-2026-49340 | gonic has arbitrary file write in createPlaylist: any authenticated user can write playlist M3U content to attacker-cont | gonic | 8.1 (v3.1) | High |
| CVE-2026-51907 | Path Traversal | - | 8.1 (v3.1) | High |
| CVE-2026-53580 | Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature | trilium | 8.1 (v3.1) | High |
| CVE-2026-54591 | AsyncSSH: SCP Path Traversal to Arbitrary File Write | asyncssh | 8.1 (v3.1) | High |
| CVE-2026-55173 | AVideo incomplete fix for CVE-2026-33482: sanitizeFFmpegCommand still allows a single '&' (background operator), giving | AVideo | 8.1 (v3.1) | High |
| CVE-2026-73659 | Trigger.dev: Cross-tenant object read/write via path traversal in packet presign API | trigger.dev | 8.1 (v3.1) | High |
| CVE-2026-90959 | Pulpcore: pulpcore: file:// scheme allowlist bypass in content upload file_url field enables arbitrary file read and pul | Red Hat Ansible Automation Platform 2.6 for RHEL 9 | 8.1 (v3.1) | High |
| CVE-2026-97875 | DNS rebinding vulnerability in rojo serve HTTP API | rojo | 8.1 (v3.1) | High |
| CVE-2009-1558 | Cisco Linksys WVC54GCA 1.00R22/1.00R24 - Local File Inclusion | wvc54gca | 7.8 (v2.0) | High |
| CVE-2010-4231 | Camtron CMNC-200 IP Camera - Directory Traversal | cmnc-200 firmware | 7.8 (v2.0) | High |
| CVE-2011-3305 | Cisco Network Access Manager Directory Traversal Vulnerability | nac manager | 7.8 (v2.0) | High |
| CVE-2011-3315 | Cisco CUCM, UCCX, and Unified IP-IVR- Directory Traversal | unified ip interactive voice response | 7.8 (v2.0) | High |
| CVE-2014-2962 | Belkin N150 Router 1.00.08/1.00.09 - Path Traversal | n150 f9k1009 firmware | 7.8 (v2.0) | High |
| CVE-2021-21315 | Node.JS System Information Library <5.3.1 - Remote Command Injection | systeminformation | 7.8 (v3.1) | High |
| CVE-2026-55864 | GeoNetwork: Unauthenticaded Server-Side Request Forgery in SLD Tool | core-geonetwork | 7.8 (v4.0) | High |
| CVE-2026-65600 | Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex | traefik | 7.8 (v4.0) | High |
| CVE-2026-67309 | Traefik v3.7.0 Path Traversal via RewriteTarget Authentication Bypass | traefik | 7.8 (v4.0) | High |
| CVE-2020-35749 | WordPress Simple Job Board <2.9.4 - Local File Inclusion | simple board job | 7.7 (v3.1) | High |
| CVE-2021-21234 | Spring Boot Actuator Logview Directory Traversal | spring-boot-actuator-logview | 7.7 (v3.1) | High |
| CVE-2021-43831 | Gradio < 2.5.0 - Arbitrary File Read | gradio | 7.7 (v3.1) | High |
| CVE-2024-46987 | Camaleon CMS Directory Traversal CVE-2024-46987 | camaleon cms | 7.7 (v3.1) | High |
| CVE-2025-46822 | Java-springboot-codebase 1.1 - Arbitrary File Read | Java-springboot-codebase | 7.7 (v4.0) | High |
| CVE-2025-59341 | esm.sh <= v136 - Local File Inclusion | esm.sh | 7.7 (v4.0) | High |
| CVE-2026-105764 | Immich: Authenticated SVG upload reaches ImageMagick coders and enables RCE | immich | 7.7 (v4.0) | High |
| CVE-2026-108161 | FusionPBX through 5.6.5 OS Command Injection via Caller ID in Recording ZIP Download | fusionpbx | 7.7 (v4.0) | High |
| CVE-2026-34936 | PraisonAI: SSRF via Unvalidated api_base in passthrough() Fallback | praisonai | 7.7 (v3.1) | High |
| CVE-2026-39843 | Plane has a Server-Side Request Forgery (SSRF) in Favicon Fetching | plane | 7.7 (v3.1) | High |
| CVE-2026-42099 | Race Condition in Sparx Pro Cloud Server | pro cloud server | 7.7 (v4.0) | High |
| CVE-2026-42345 | FastGPT: Cloud metadata endpoint SSRF protection bypass via port specification, IPv6 mapping, hex/decimal IP encoding, a | FastGPT | 7.7 (v3.1) | High |
| CVE-2026-43884 | WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() | AVideo | 7.7 (v3.1) | High |
| CVE-2026-47170 | Garlic-Hub: SSRF vulnerability in uploadFromUrl endpoint | garlic-hub | 7.7 (v3.1) | High |
| CVE-2026-47179 | Arcane: Authenticated Arbitrary Host File Read via Docker Compose Include Directives in Arcane | arcane | 7.7 (v3.1) | High |
| CVE-2026-53549 | Termix: Server-Side Request Forgery via Proxy Connectivity Test | Termix | 7.7 (v3.1) | High |
| CVE-2026-54910 | FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files | filebrowser | 7.7 (v3.1) | High |
| CVE-2026-56285 | Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint | nitter | 7.7 (v4.0) | High |
| CVE-2026-61835 | Directus: SSRF Protection Bypass via 0.0.0.0 in File Import | directus | 7.7 (v3.1) | High |
| CVE-2026-63088 | stoatchat < 0.14.0 SSRF via DNS-based IP Blocklist Bypass | stoatchat | 7.7 (v4.0) | High |
| CVE-2026-63764 | LMDeploy Server-Side Request Forgery via HTTP Redirect Bypass | lmdeploy | 7.7 (v4.0) | High |
| CVE-2026-66738 | SPIP < 4.4.18 Code Injection via Navigation Endpoint on SQLite | SPIP | 7.7 (v4.0) | High |
| CVE-2026-67346 | Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass | swarms | 7.7 (v4.0) | High |
| CVE-2026-69192 | ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trus | ip-address | 7.7 (v4.0) | High |
| CVE-2026-73498 | MCP Atlassian is a Model Context Protocol (MCP): Arbitrary file read via missing path validation in confluence_upload_at | mcp-atlassian | 7.7 (v3.1) | High |
| CVE-2026-75888 | Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch | Red Hat OpenShift Container Platform 4.14 | 7.7 (v3.1) | High |
| CVE-2026-76898 | draw.io: Unauthenticated SSRF via IPv6 ULA blocklist bypass in /embed2.js | drawio | 7.7 (v4.0) | High |
| CVE-2026-77775 | Headroom Proxy Sends Upstream Requests to a Client-Supplied Base URL Without Address Validation | Headroom | 7.7 (v4.0) | High |
| CVE-2026-79764 | Termix: Authenticated SSRF via /homepage/proxy — No Destination Allowlist | Termix | 7.7 (v3.1) | High |
| CVE-2026-8183 | Langflow OSS is affected by arbitrary code execution in custom component validation and trusted code enforcement | langflow | 7.7 (v3.1) | High |
| CVE-2026-105628 | Plane: OAuth Avatar Redirect SSRF Leads to Internal Data Exfiltration via Static Asset Endpoint | plane | 7.6 (v3.1) | High |
| CVE-2026-44239 | FreePBX: Authenticated Local File Inclusion in Dashboard Module | freepbx | 7.6 (v4.0) | High |
| CVE-2026-55177 | CloudTAK: Authenticated full-read SSRF in /api/esri* routes — user-controlled URL fetched with no IP-classification guar | CloudTAK | 7.6 (v4.0) | High |
| CVE-2026-55232 | Vvveb: Server-side request forgery in Vvveb via IPv6 bypass of validateUrl() in editor oEmbed proxy | Vvveb | 7.6 (v3.1) | High |
| CVE-2026-79749 | MCPHub: SSRF Guard Bypass via IPv6 Transition Addresses in URL Validation | mcphub | 7.6 (v4.0) | High |
| CVE-2006-2842 | Squirrelmail <=1.4.6 - Local File Inclusion | squirrelmail | 7.5 (v2.0) | High |
| CVE-2009-0255 | TYPO3 sa-2009-001 Weak Encryption Key File Disclosure | typo3 | 7.5 (v3.1) | High |
| CVE-2009-2015 | Joomla! MooFAQ 1.0 - Local File Inclusion | Joomla! | 7.5 (v2.0) | High |
| CVE-2009-3318 | Joomla! Roland Breedveld Album 1.14 - Local File Inclusion | Joomla! | 7.5 (v2.0) | High |
| CVE-2009-4202 | Joomla! Omilen Photo Gallery 0.5b - Local File Inclusion | joomla! | 7.5 (v2.0) | High |
| CVE-2009-4679 | Joomla! Portfolio Nexus - Remote File Inclusion | com if nexus | 7.5 (v2.0) | High |
| CVE-2010-0157 | Joomla! Component com_biblestudy - Local File Inclusion | joomla! | 7.5 (v2.0) | High |
| CVE-2010-0759 | Joomla! Plugin Core Design Scriptegrator - Local File Inclusion | scriptegrator plugin | 7.5 (v2.0) | High |
| CVE-2010-0972 | Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion | com gcalendar | 7.5 (v2.0) | High |
| CVE-2010-0985 | Joomla! Component com_abbrev - Local File Inclusion | com abbrev | 7.5 (v2.0) | High |
| CVE-2010-1306 | Joomla! Component Picasa 2.0 - Local File Inclusion | com joomlapicasa2 | 7.5 (v2.0) | High |
| CVE-2010-1470 | Joomla! Component Web TV 1.0 - Local File Inclusion | com webtv | 7.5 (v2.0) | High |
| CVE-2010-1471 | Joomla! Component Address Book 1.5.0 - Local File Inclusion | com addressbook | 7.5 (v2.0) | High |
| CVE-2010-1472 | Joomla! Component Horoscope 1.5.0 - Local File Inclusion | com horoscope | 7.5 (v2.0) | High |
| CVE-2010-1495 | Joomla! Component Matamko 1.01 - Local File Inclusion | com matamko | 7.5 (v2.0) | High |
| CVE-2010-1531 | Joomla! Component redSHOP 1.0 - Local File Inclusion | com redshop | 7.5 (v2.0) | High |
| CVE-2010-1533 | Joomla! Component TweetLA 1.0.1 - Local File Inclusion | com tweetla | 7.5 (v2.0) | High |
| CVE-2010-1535 | Joomla! Component TRAVELbook 1.0.1 - Local File Inclusion | com travelbook | 7.5 (v2.0) | High |
| CVE-2010-1602 | Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion | com zimbcomment | 7.5 (v2.0) | High |
| CVE-2010-1603 | Joomla! Component ZiMBCore 0.1 - Local File Inclusion | com zimbcore | 7.5 (v2.0) | High |
| CVE-2010-1653 | Joomla! Component Graphics 1.0.6 - Local File Inclusion | com graphics | 7.5 (v2.0) | High |
| CVE-2010-1717 | Joomla! Component iF surfALERT 1.2 - Local File Inclusion | if surfalert | 7.5 (v2.0) | High |
| CVE-2010-1875 | Joomla! Component Property - Local File Inclusion | com properties | 7.5 (v2.0) | High |
| CVE-2010-1878 | Joomla! Component OrgChart 1.0.0 - Local File Inclusion | com orgchart | 7.5 (v2.0) | High |
| CVE-2010-1952 | Joomla! Component BeeHeard 1.0 - Local File Inclusion | com beeheard | 7.5 (v2.0) | High |
| CVE-2010-1953 | Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion | com multimap | 7.5 (v2.0) | High |
| CVE-2010-1954 | Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion | com multiroot | 7.5 (v2.0) | High |
| CVE-2010-1955 | Joomla! Component Deluxe Blog Factory 1.1.2 - Local File Inclusion | com blogfactory | 7.5 (v2.0) | High |
| CVE-2010-1956 | Joomla! Component Gadget Factory 1.0.0 - Local File Inclusion | com gadgetfactory | 7.5 (v2.0) | High |
| CVE-2010-1957 | Joomla! Component Love Factory 1.3.4 - Local File Inclusion | com lovefactory | 7.5 (v2.0) | High |
| CVE-2010-1977 | Joomla! Component J!WHMCS Integrator 1.5.0 - Local File Inclusion | com jwhmcs | 7.5 (v2.0) | High |
| CVE-2010-1980 | Joomla! Component Joomla! Flickr 1.0 - Local File Inclusion | com joomlaflickr | 7.5 (v2.0) | High |
| CVE-2010-1983 | Joomla! Component redTWITTER 1.0 - Local File Inclusion | com redtwitter | 7.5 (v2.0) | High |
| CVE-2010-2033 | Joomla! Percha Categories Tree 0.6 - Local File Inclusion | com perchacategoriestree | 7.5 (v2.0) | High |
| CVE-2010-2034 | Joomla! Component Percha Image Attach 1.1 - Directory Traversal | com perchaimageattach | 7.5 (v2.0) | High |
| CVE-2010-2035 | Joomla! Component Percha Gallery 1.6 Beta - Directory Traversal | com perchagallery | 7.5 (v2.0) | High |
| CVE-2010-2036 | Joomla! Component Percha Fields Attach 1.0 - Directory Traversal | com perchafieldsattach | 7.5 (v2.0) | High |
| CVE-2010-2037 | Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal | com perchadownloadsattach | 7.5 (v2.0) | High |
| CVE-2010-2045 | Joomla! Component FDione Form Wizard 1.0.2 - Local File Inclusion | com dioneformwizard | 7.5 (v2.0) | High |
| CVE-2010-2050 | Joomla! Component MS Comment 0.8.0b - Local File Inclusion | com mscomment | 7.5 (v2.0) | High |
| CVE-2010-2128 | Joomla! Component JE Quotation Form 1.0b1 - Local File Inclusion | com jequoteform | 7.5 (v2.0) | High |
| CVE-2010-2259 | Joomla! Component com_bfsurvey - Local File Inclusion | com bfsurvey profree | 7.5 (v2.0) | High |
| CVE-2010-2682 | Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion | com realtyna | 7.5 (v2.0) | High |
| CVE-2010-2918 | Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion | com joomla visites | 7.5 (v2.0) | High |
| CVE-2010-3426 | Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion | com jphone | 7.5 (v2.0) | High |
| CVE-2010-4282 | Pandora Fms < 3.1.1 - Directory Traversal | pandora fms | 7.5 (v2.0) | High |
| CVE-2010-4719 | Joomla! Component JRadio - Local File Inclusion | com jradio | 7.5 (v2.0) | High |
| CVE-2010-4769 | Joomla! Component Jimtawl 1.0.2 - Local File Inclusion | com jimtawl | 7.5 (v2.0) | High |
| CVE-2010-4977 | Joomla! Component Canteen 1.0 - Local File Inclusion | com canteen | 7.5 (v2.0) | High |
| CVE-2010-5028 | Joomla! Component JE Job 1.0 - Local File Inclusion | com jejob | 7.5 (v2.0) | High |
| CVE-2011-4166 | HP Managed Printing Administration jobAcct Remote Command Execution | managed printing administration | 7.5 (v2.0) | High |
| CVE-2012-1226 | Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities | dolibarr erp/crm | 7.5 (v2.0) | High |
| CVE-2012-5202 | HP Intelligent Management FaultDownloadServlet Directory Traversal | intelligent management center | 7.5 (v2.0) | High |
| CVE-2012-5203 | HP Intelligent Management ReportImgServlt Directory Traversal | intelligent management center for automated network manager | 7.5 (v2.0) | High |
| CVE-2012-5204 | HP Intelligent Management IctDownloadServlet Directory Traversal | intelligent management center | 7.5 (v2.0) | High |
| CVE-2013-1081 | Novell Zenworks Mobile Managment MDM.php Local File Inclusion Vulnerability | zenworks mobile management | 7.5 (v2.0) | High |
| CVE-2014-10037 | DomPHP 0.83 - Directory Traversal | domphp | 7.5 (v2.0) | High |
| CVE-2014-3744 | Node.js st module Directory Traversal | node.js | 7.5 (v3.0) | High |
| CVE-2014-7863 | ManageEngine Multiple Products Arbitrary File Download | manageengine applications manager | 7.5 (v3.1) | High |
| CVE-2014-9707 | Embedthis GoAhead Embedded Web Server Directory Traversal | goahead | 7.5 (v2.0) | High |
| CVE-2015-1000005 | WordPress Candidate Application Form <= 1.3 - Local File Inclusion | candidate-application-form | 7.5 (v3.0) | High |
| CVE-2015-1000010 | WordPress Simple Image Manipulator < 1.0 - Local File Inclusion | simple-image-manipulator | 7.5 (v3.0) | High |
| CVE-2015-1000012 | WordPress MyPixs <=0.3 - Local File Inclusion | mypixs | 7.5 (v3.0) | High |
| CVE-2015-10134 | WordPress Simple Backup File Read Vulnerability | simple backup | 7.5 (v3.1) | High |
| CVE-2015-1486 | Symantec Endpoint Protection Manager Authentication Bypass and Code Execution | endpoint protection manager | 7.5 (v2.0) | High |
| CVE-2015-1503 | IceWarp Mail Server < 11.1.1 - Directory Traversal | mail server | 7.5 (v3.0) | High |
| CVE-2015-1592 | SixApart MovableType Storable Perl Code Execution | debian linux | 7.5 (v2.0) | High |
| CVE-2015-3035 | Archer C7 Directory Traversal Vulnerability | tl-wr741nd firmware | 7.5 (v3.1) | High |
| CVE-2015-3648 | ResourceSpace - Local File inclusion | resourcespace | 7.5 (v2.0) | High |
| CVE-2015-4074 | Joomla! Helpdesk Pro plugin <1.4.0 - Local File Inclusion | helpdesk pro | 7.5 (v3.0) | High |
| CVE-2015-4632 | Koha 3.20.1 - Directory Traversal | koha | 7.5 (v3.0) | High |
| CVE-2015-5469 | WordPress MDC YouTube Downloader 2.1.0 - Local File Inclusion | mdc youtube downloader | 7.5 (v3.0) | High |
| CVE-2015-9406 | WordPress Mobile Edition File Read Vulnerability | mtheme-unus | 7.5 (v3.1) | High |
| CVE-2016-10956 | WordPress Mail Masta 1.0 - Local File Inclusion | mail-masta | 7.5 (v3.1) | High |
| CVE-2016-2389 | SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion | netweaver | 7.5 (v3.0) | High |
| CVE-2016-6601 | WebNMS Framework Server Arbitrary Text File Download | webnms framework | 7.5 (v3.0) | High |
| CVE-2017-1000028 | Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion | glassfish server | 7.5 (v3.0) | High |
| CVE-2017-1000029 | Oracle GlassFish Server Open Source Edition 3.0.1 - Local File Inclusion | glassfish server | 7.5 (v3.0) | High |
| CVE-2017-14849 | Node.js 8.5.0 Path Traversal (CVE-2017-14849) | node.js | 7.5 (v3.0) | High |
| CVE-2017-15647 | FiberHome Routers - Local File Inclusion | routerfiberhome firmware | 7.5 (v3.0) | High |
| CVE-2017-16806 | Ulterius Server File Download Vulnerability | ulterius server | 7.5 (v3.0) | High |
| CVE-2017-16877 | Nextjs <2.4.1 - Local File Inclusion | next.js | 7.5 (v3.0) | High |
| CVE-2017-5982 | Kodi 17.0 Local File Inclusion Vulnerability | kodi | 7.5 (v3.0) | High |
| CVE-2017-6190 | D-Link DWR-116 / DWR-116A1 - Arbitrary File Download | dwr-116 firmware | 7.5 (v3.0) | High |
| CVE-2017-6527 | DnaLIMS Directory Traversal | dnalims | 7.5 (v3.0) | High |
| CVE-2017-9833 | BOA Web Server 0.94.14 - Arbitrary File Access | boa | 7.5 (v3.1) | High |
| CVE-2018-10822 | D-Link Routers - Local File Inclusion | dwr-116 firmware | 7.5 (v3.1) | High |
| CVE-2018-10956 | IPConfigure Orchid Core VMS 2.0.5 - Local File Inclusion | orchid core vms | 7.5 (v3.0) | High |
| CVE-2018-12909 | Webgrind <= 1.5 - Local File Inclusion | webgrind | 7.5 (v3.0) | High |
| CVE-2018-14912 | cgit Directory Traversal | cgit | 7.5 (v3.0) | High |
| CVE-2018-14918 | LOYTEC LGATE-902 6.3.2 - Local File Inclusion | lgate-902 firmware | 7.5 (v3.0) | High |
| CVE-2018-15138 | LG-Ericsson iPECS NMS 30M - Local File Inclusion | ipecs nms | 7.5 (v3.0) | High |
| CVE-2018-15535 | Responsive FileManager < 9.13.4 - Directory Traversal | responsive filemanager | 7.5 (v3.0) | High |
| CVE-2018-15745 | Argus Surveillance DVR 4.0.0.0 - Directory Traversal | dvr | 7.5 (v3.0) | High |
| CVE-2018-16299 | WordPress Localize My Post 1.0 - Local File Inclusion | localize my post | 7.5 (v3.0) | High |
| CVE-2018-18323 | Centos Web Panel 0.9.8.480 - Local File Inclusion | webpanel | 7.5 (v3.0) | High |
| CVE-2018-19326 | Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion | vmg1312-b10d firmware | 7.5 (v3.0) | High |
| CVE-2018-19458 | PHP Proxy 3.0.3 - Local File Inclusion | php-proxy | 7.5 (v3.0) | High |
| CVE-2018-19753 | Tarantella Enterprise <3.11 - Local File Inclusion | tarantella enterprise | 7.5 (v3.0) | High |
| CVE-2018-3760 | Ruby On Rails - Local File Inclusion | cloudforms | 7.5 (v3.0) | High |
| CVE-2018-6008 | Joomla! Jtag Members Directory 5.3.7 - Local File Inclusion | jtag members directory | 7.5 (v3.0) | High |
| CVE-2018-6184 | Zeit Next.js < 4.2.3 - Local File Inclusion | next.js | 7.5 (v3.0) | High |
| CVE-2018-7422 | WordPress Site Editor <=1.1.1 - Local File Inclusion | site editor | 7.5 (v3.0) | High |
| CVE-2018-7490 | uWSGI PHP Plugin Local File Inclusion | uwsgi | 7.5 (v3.0) | High |
| CVE-2018-9205 | Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion | avatar uploader | 7.5 (v3.0) | High |
| CVE-2019-12276 | GrandNode 4.40 - Local File Inclusion | grandnode | 7.5 (v3.0) | High |
| CVE-2019-14251 | T24 Web Server - Local File Inclusion | t24 | 7.5 (v3.1) | High |
| CVE-2019-16123 | PilusCart <=1.4.1 - Local File Inclusion | piluscart | 7.5 (v3.1) | High |
| CVE-2019-17199 | WebPageTest Directory Traversal | webpagetest | 7.5 (v3.1) | High |
| CVE-2019-17538 | Jiangnan Online Judge 0.8.0 - Local File Inclusion | jiangnan online judge | 7.5 (v3.1) | High |
| CVE-2019-18371 | Xiaomi Mi WiFi R3G Routers - Local file Inclusion | millet router 3g firmware | 7.5 (v3.1) | High |
| CVE-2019-18665 | DOMOS 5.5 - Local File Inclusion | domos | 7.5 (v3.1) | High |
| CVE-2019-18922 | Allied Telesis AT-GS950/8 - Local File Inclusion | at-gs950/8 firmware | 7.5 (v3.1) | High |
| CVE-2019-7254 | eMerge E3 1.00-06 - Local File Inclusion | linear emerge essential firmware | 7.5 (v3.1) | High |
| CVE-2019-7315 | Genie Access WIP3BVAF IP Camera - Local File Inclusion | wip3bvaf | 7.5 (v3.0) | High |
| CVE-2019-9922 | Joomla! Harmis Messenger 1.2.2 - Local File Inclusion | je messenger | 7.5 (v3.1) | High |
| CVE-2020-11738 | WordPress Duplicator File Read Vulnerability | duplicator | 7.5 (v3.1) | High |
| CVE-2020-12447 | Onkyo TX-NR585 Web Interface - Directory Traversal | tx-nr585 firmware | 7.5 (v3.1) | High |
| CVE-2020-13158 | Artica Proxy Community Edition <4.30.000000 - Local File Inclusion | artica proxy | 7.5 (v3.1) | High |
| CVE-2020-14864 | Oracle Fusion - Directory Traversal/Local File Inclusion | business intelligence | 7.5 (v3.1) | High |
| CVE-2020-17519 | Apache Flink JobManager Traversal | flink | 7.5 (v3.1) | High |
| CVE-2020-19360 | FHEM 6.0 - Local File Inclusion | fhem | 7.5 (v3.1) | High |
| CVE-2020-23575 | Kyocera Printer d-COPIA253MF - Directory Traversal | d-copia253mf plus firmware | 7.5 (v3.1) | High |
| CVE-2020-24285 | INTELBRAS TELEFONE IP TIP200 60.61.75.22 - Local File Inclusion | tip200 | 7.5 (v3.1) | High |
| CVE-2020-26073 | Cisco SD-WAN vManage Software - Local File Inclusion | catalyst sd-wan manager | 7.5 (v3.1) | High |
| CVE-2020-27191 | LionWiki <3.2.12 - Local File Inclusion | lionwiki | 7.5 (v3.1) | High |
| CVE-2020-27467 | Processwire CMS <2.7.1 - Local File Inclusion | processwire | 7.5 (v3.1) | High |
| CVE-2020-35580 | SearchBlox <9.2.2 - Local File Inclusion | searchblox | 7.5 (v3.1) | High |
| CVE-2020-35598 | Advanced Comment System 1.0 - Local File Inclusion | advanced comment system | 7.5 (v3.1) | High |
| CVE-2020-35736 | GateOne 1.1 - Local File Inclusion | gateone | 7.5 (v3.1) | High |
| CVE-2020-8209 | Citrix XenMobile Server - Local File Inclusion | xenmobile server | 7.5 (v3.1) | High |
| CVE-2021-20123 | Draytek VigorConnect 1.6.0-B - Local File Inclusion | vigorconnect | 7.5 (v3.1) | High |
| CVE-2021-20124 | Draytek VigorConnect 6.0-B3 - Local File Inclusion | vigorconnect | 7.5 (v3.1) | High |
| CVE-2021-24227 | Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion | patreon wordpress | 7.5 (v3.1) | High |
| CVE-2021-25864 | Hue Magic 3.0.0 - Local File Inclusion | huemagic | 7.5 (v3.1) | High |
| CVE-2021-3223 | Node RED Dashboard <2.26.2 - Local File Inclusion | node-red-dashboard | 7.5 (v3.1) | High |
| CVE-2021-39316 | WordPress DZS Zoomsounds <=6.50 - Local File Inclusion | zoomsounds | 7.5 (v3.1) | High |
| CVE-2021-39433 | BIQS IT Biqs-drive v1.83 Local File Inclusion | biqsdrive | 7.5 (v3.1) | High |
| CVE-2021-40978 | MKdocs 1.2.2 - Directory Traversal | mkdocs | 7.5 (v3.1) | High |
| CVE-2021-41277 | Metabase Pre-Auth Local File Inclusion (CVE-2021-41277) | metabase | 7.5 (v3.1) | High |
| CVE-2021-41291 | ECOA Building Automation System - Directory Traversal Content Disclosure | ecs router controller-ecs firmware | 7.5 (v3.1) | High |
| CVE-2021-41569 | SAS/Internet 9.4 1520 - Local File Inclusion | sas/intrnet | 7.5 (v3.1) | High |
| CVE-2021-43287 | Pre-Auth Takeover of Build Pipelines in GoCD | gocd | 7.5 (v3.1) | High |
| CVE-2021-43495 | AlquistManager Local File Inclusion | alquist | 7.5 (v3.1) | High |
| CVE-2021-43496 | Clustering Local File Inclusion | clustering | 7.5 (v3.1) | High |
| CVE-2021-43734 | kkFileview v4.0.0 - Local File Inclusion | kkfileview | 7.5 (v3.1) | High |
| CVE-2021-43778 | GLPI plugin Barcode < 2.6.1 - Path Traversal Vulnerability. | barcode | 7.5 (v3.1) | High |
| CVE-2021-43798 | Grafana 8.x Plugin Module File Path Traversal (CVE-2021-43798) | grafana | 7.5 (v3.1) | High |
| CVE-2021-46107 | Ligeo Archives Ligeo Basics - Server Side Request Forgery | ligeo basics | 7.5 (v3.1) | High |
| CVE-2021-46417 | Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion (LFI) | colibri firmware | 7.5 (v3.1) | High |
| CVE-2022-24716 | Icingaweb Directory Traversal in Static Library File Requests | icinga web 2 | 7.5 (v3.1) | High |
| CVE-2022-27043 | Yearning - Directory Traversal | yearning | 7.5 (v3.1) | High |
| CVE-2022-29298 | SolarView Compact 6.00 - Local File Inclusion | sv-cpt-mc310 firmware | 7.5 (v3.1) | High |
| CVE-2022-31474 | BackupBuddy - Local File Inclusion | backupbuddy | 7.5 (v3.1) | High |
| CVE-2022-33901 | WordPress MultiSafepay for WooCommerce <=4.13.1 - Arbitrary File Read | multisafepay plugin for woocommerce | 7.5 (v3.1) | High |
| CVE-2022-37122 | Carel pCOWeb HVAC BACnet Gateway 2.1.0 - Path Traversal | pcoweb hvac bacnet gateway | 7.5 (v3.1) | High |
| CVE-2022-38794 | Zaver - Local File Inclusion | zaver | 7.5 (v3.1) | High |
| CVE-2022-4140 | WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access | welcart e-commerce | 7.5 (v3.1) | High |
| CVE-2022-47501 | Apache OFBiz < 18.12.07 - Local File Inclusion | ofbiz | 7.5 (v3.1) | High |
| CVE-2023-0126 | SonicWall SMA1000 LFI | sma1000 | 7.5 (v3.1) | High |
| CVE-2023-22047 | Oracle Peoplesoft - Unauthenticated File Read | peoplesoft enterprise | 7.5 (v3.1) | High |
| CVE-2023-23063 | Cellinx NVT Web Server - Local File Disclosure | nvt web server | 7.5 (v3.1) | High |
| CVE-2023-26256 | STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion | stagil navigation | 7.5 (v3.1) | High |
| CVE-2023-29887 | Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion | spreadsheet-reader | 7.5 (v3.1) | High |
| CVE-2023-32315 | Openfire authentication bypass with RCE plugin | openfire | 7.5 (v3.1) | High |
| CVE-2023-33510 | Jeecg P3 Biz Chat - Local File Inclusion | jeecg p3 biz chat | 7.5 (v3.1) | High |
| CVE-2023-35843 | NocoDB version <= 0.106.1 - Arbitrary File Read | nocodb | 7.5 (v3.1) | High |
| CVE-2023-35844 | Lightdash version <= 0.510.3 Arbitrary File Read | lightdash | 7.5 (v3.1) | High |
| CVE-2023-37474 | Copyparty <= 1.8.2 - Directory Traversal | copyparty | 7.5 (v3.1) | High |
| CVE-2023-38879 | openSIS v9.0 - Path Traversal | opensis | 7.5 (v3.1) | High |
| CVE-2023-39141 | Aria2 WebUI - Path traversal | webui-aria2 | 7.5 (v3.1) | High |
| CVE-2023-40924 | SolarView Compact < 6.00 - Directory Traversal | solarview compact firmware | 7.5 (v3.1) | High |
| CVE-2023-51449 | Gradio File Path Traversal (CVE-2023-51449) | gradio | 7.5 (v3.1) | High |
| CVE-2023-6020 | Ray Static File - Local File Inclusion | ray | 7.5 (v3.1) | High |
| CVE-2023-6023 | VertaAI ModelDB - Path Traversal | modeldb | 7.5 (v3.1) | High |
| CVE-2023-6038 | H2O ImportFiles - Local File Inclusion | h2o | 7.5 (v3.1) | High |
| CVE-2024-23334 | aiohttp Directory Traversal Vulnerability (CVE-2024-23334) | aiohttp | 7.5 (v3.1) | High |
| CVE-2024-27292 | Docassemble - Local File Inclusion | docassemble | 7.5 (v3.1) | High |
| CVE-2024-28995 | SolarWinds Serv-U Unauthenticated Arbitrary File Read | serv-u | 7.5 (v3.1) | High |
| CVE-2024-38816 | WebMvc.fn/WebFlux.fn - Path Traversal | Spring | 7.5 (v3.1) | High |
| CVE-2024-38819 | Spring Framework Path Traversal in Functional Web Frameworks | spring framework | 7.5 (v3.1) | High |
| CVE-2024-41628 | Cluster Control CMON API - Directory Traversal | cluster control | 7.5 (v3.1) | High |
| CVE-2024-4956 | Nexus Repository Manager 3 Unauthenticated Path Traversal (CVE-2024-4956) | Nexus Repository | 7.5 (v3.1) | High |
| CVE-2024-5334 | Devika - Local File Inclusion | devika | 7.5 (v3.0) | High |
| CVE-2024-9362 | Polyaxon - Unauthenticated Directory Traversal | polyaxon/polyaxon | 7.5 (v3.0) | High |
| CVE-2024-9935 | PDF Generator Addon for Elementor Page Builder <= 1.7.5 - Arbitrary File Download | pdf-generator-addon-for-elementor-page-builder | 7.5 (v3.1) | High |
| CVE-2025-11371 | Gladinet CentreStack/Triofox Path Traversal | centrestack | 7.5 (v3.1) | High |
| CVE-2025-11704 | Elegance Menu <= 1.9 - Authenticated (Contributor+) Local File Inclusion | Elegance Menu | 7.5 (v3.1) | High |
| CVE-2025-13339 | Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read | Hippoo Mobile App for WooCommerce | 7.5 (v3.1) | High |
| CVE-2025-13801 | Yoco Payments <= 3.8.8 - Path Traversal | Yoco Payments | 7.5 (v3.1) | High |
| CVE-2025-24963 | Vitest Browser Mode - Local File Read | vitest | 7.5 (v3.1) | High |
| CVE-2025-30208 | Vite Development Server Arbitrary File Read Bypass (CVE-2025-30208) | vite | 7.5 (v3.1) | High |
| CVE-2025-31125 | Vite Development Server - Path Traversal | vite | 7.5 (v3.1) | High |
| CVE-2025-31131 | Yeswiki < 4.5.2 - Unauthenticated Path Traversal | yeswiki | 7.5 (v3.1) | High |
| CVE-2025-45145 | Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 Path Traversal Vulnerability | - | 7.5 (v3.1) | High |
| CVE-2025-57231 | Docmost 0.2.1-0.21.0 - Arbitrary File Read | docmost | 7.5 (v3.1) | High |
| CVE-2025-59049 | Mockoon < 9.2.0 - Path Traversal | mockoon | 7.5 (v3.1) | High |
| CVE-2025-59527 | FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability | flowise | 7.5 (v3.1) | High |
| CVE-2025-61884 | Oracle E-Business Suite - Server-Side Request Forgery | configurator | 7.5 (v3.1) | High |
| CVE-2025-65878 | warehouse management system Path Traversal Vulnerability | warehouse management system | 7.5 (v3.1) | High |
| CVE-2025-66645 | NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading | nicegui | 7.5 (v3.1) | High |
| CVE-2025-69411 | ionCube Tester Plus <= 1.3 - Local File Inclusion | ionCube tester plus | 7.5 (v3.1) | High |
| CVE-2026-0669 | Path Traversal vulnerability in CSS extension on certain web servers | css | 7.5 (v3.1) | High |
| CVE-2026-12609 | Eclipse Theia - Unauthenticated Path Traversal | theia | 7.5 (v3.1) | High |
| CVE-2026-14490 | Demi <= 0.0.6 - Unauthenticated Arbitrary Directory Deletion via demi_restore_step AJAX action | Demi – One Click Demo Import, Backup & Site Migration | 7.5 (v3.1) | High |
| CVE-2026-18352 | User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter | User Access Manager | 7.5 (v3.1) | High |
| CVE-2026-24138 | FOG vulnerable to unauthenticated SSRF via /fog/service/getversion.php | fogproject | 7.5 (v3.1) | High |
| CVE-2026-29962 | HSC MailInspector - Local File Inclusion | mailinspector | 7.5 (v3.1) | High |
| CVE-2026-32820 | dataCycle Public Markdown Path Traversal Via /docs/*path | dataCycle-CORE | 7.5 (v3.1) | High |
| CVE-2026-34239 | Chamilo Authenticated Remote Code Execution | chamilo-lms | 7.5 (v4.0) | High |
| CVE-2026-35036 | Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature | ech0 | 7.5 (v3.1) | High |
| CVE-2026-36783 | Shenzhen Tenda Technology Co., Ltd Tenda O3 Wireless Router v1.0.0.5(4180) was discovered to Denial of Service Vulnerability | - | 7.5 (v3.1) | High |
| CVE-2026-36796 | Shenzhen Tenda Technology Co., Ltd Tenda G0 v15.11.0.5 was discovered to Denial of Service Vulnerability | - | 7.5 (v3.1) | High |
| CVE-2026-39847 | Emmett has a path traversal in internal assets handler | emmett | 7.5 (v3.1) | High |
| CVE-2026-41180 | PsiTransfer: Upload PATCH path traversal can create config.<NODE_ENV>.js and lead to code execution on restart | psitransfer | 7.5 (v3.1) | High |
| CVE-2026-44716 | Pipecat: Path Traversal in Pipecat Runner /files Endpoint — Arbitrary File Read via %2F-Encoded Separator | pipecat | 7.5 (v3.1) | High |
| CVE-2026-46581 | mojarra Path Traversal Vulnerability | mojarra | 7.5 (v3.1) | High |
| CVE-2026-50547 | InvoicePlane permits local file inclusion through the e-invoice XML configuration identifier | InvoicePlane | 7.5 (v3.1) | High |
| CVE-2026-50776 | Pronis Loisirs Billetterie CSE - < 04/2026 Arbitrary Code Execution Vulnerability | Pronis Loisirs Billetterie CSE - < 04/2026 | 7.5 (v3.1) | High |
| CVE-2026-53534 | JabRef CAYW Sublime Text integration permits operating-system command injection | jabref | 7.5 (v4.0) | High |
| CVE-2026-53599 | Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mo | core | 7.5 (v3.1) | High |
| CVE-2026-54293 | NLTK: URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File Read | nltk | 7.5 (v3.1) | High |
| CVE-2026-54629 | Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode | anyquery | 7.5 (v3.1) | High |
| CVE-2026-5487 | DriveLock Directory Traversal Information Disclosure Vulnerability | DriveLock | 7.5 (v3.0) | High |
| CVE-2026-5491 | DriveLock Directory Traversal Information Disclosure Vulnerability | DriveLock | 7.5 (v3.0) | High |
| CVE-2026-55552 | Yamcs <=5.11.12 - Arbitrary File Read | yamcs | 7.5 (v3.1) | High |
| CVE-2026-56671 | ComfyUI: Path traversal in /experiment/models/preview allows arbitrary image file read | ComfyUI | 7.5 (v3.1) | High |
| CVE-2026-61891 | theia Exposure of Sensitive Information to an Unauthorized Actor Vulnerability | theia | 7.5 (v3.1) | High |
| CVE-2026-71209 | audiobookshelf - %2F Encoding Discrepancy Bypasses Cover/Image Auth Exemption Regex, Enabling Unauthenticated Path Trave | audiobookshelf | 7.5 (v3.1) | High |
| CVE-2026-75328 | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java Path Traversal Vulnerability | In DocSys-master V2.02.85, the downloadDocEx interface in src/com/DocSystem/controller/DocController.java | 7.5 (v3.1) | High |
| CVE-2026-75333 | yx-image-recognition v1.0 Path Traversal Vulnerability | - | 7.5 (v3.1) | High |
| CVE-2026-75887 | Openshift/console: openshift/console: unauthenticated path traversal in i18n locale handler | Red Hat OpenShift Container Platform 4.12 | 7.5 (v3.1) | High |
| CVE-2026-88392 | Unimall v4 Arbitrary Code Execution Vulnerability | - | 7.5 (v3.1) | High |
| CVE-2026-88394 | WookTeam 1.6.6 and Earlier Path Traversal Vulnerability | - | 7.5 (v3.1) | High |
| CVE-2026-91136 | Divi Plus <= 2.4.0 - Unauthenticated Arbitrary File Read | Divi Plus | 7.5 (v3.1) | High |
| CVE-2026-95265 | Feehi CMS 2.1.1 Server-Side Request Forgery Vulnerability | Feehi CMS 2.1.1 | 7.5 (v3.1) | High |
| CVE-2024-20767 | CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read | coldfusion | 7.4 (v3.1) | High |
| CVE-2026-45310 | CodeWhale: SSRF via HTTP Redirect Bypass in fetch_url Tool | CodeWhale | 7.4 (v3.1) | High |
| CVE-2025-45869 | LogicalDOC Enterprise Version up to and before v9.1.1 Server-Side Request Forgery Vulnerability | - | 7.3 (v3.1) | High |
| CVE-2025-68619 | Signal K Server Vulnerable to Remote Code Execution via Malicious npm Package | signal k server | 7.3 (v4.0) | High |
| CVE-2026-19771 | Baicells EG3661M LuCI Web luci os command injection | EG3661M | 7.3 (v4.0) | High |
| CVE-2019-11539 | Pulse Secure VPN Arbitrary Command Execution | connect secure | 7.2 (v3.1) | High |
| CVE-2022-1373 | Softing Secure Integration Server v1.22 Remote Code Execution | edgeaggregator | 7.2 (v3.1) | High |
| CVE-2022-2334 | Softing Secure Integration Server v1.22 Remote Code Execution | edgeaggregator | 7.2 (v3.1) | High |
| CVE-2022-27925 | Zip Path Traversal in Zimbra (mboximport) (CVE-2022-27925) | zimbra collaboration suite | 7.2 (v3.1) | High |
| CVE-2025-48868 | Horilla vulnerable to authenticated RCE via eval() in project_bulk_archive | horilla | 7.2 (v3.1) | High |
| CVE-2025-58762 | Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and Script notification agent | tautulli | 7.2 (v3.1) | High |
| CVE-2025-58763 | Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection | tautulli | 7.2 (v3.1) | High |
| CVE-2026-20297 | Path Traversal through 'explicit_appname' in the App Install REST Endpoint in Splunk Enterprise | splunk | 7.2 (v3.1) | High |
| CVE-2026-27891 | Remote Code Execution (RCE) via Zip Slip in Plugin Upload Mechanism | facturascripts | 7.2 (v3.1) | High |
| CVE-2026-34607 | Emlog: Path Traversal in emUnZip() allows arbitrary file write leading to RCE | emlog | 7.2 (v3.1) | High |
| CVE-2026-35174 | Chyrp Lite has a Path Traversal to Remote Code Execution | chyrp lite | 7.2 (v3.1) | High |
| CVE-2026-3576 | Wordpress Planyo Online Reservation System Arbitrary File Read (CVE-2026-3576) | Planyo online reservation system | 7.2 (v3.1) | High |
| CVE-2026-39387 | BoidCMS: Local File Inclusion (LFI) leads to Remote Code Execution (RCE) via tpl parameter | boidcms | 7.2 (v3.1) | High |
| CVE-2026-58372 | SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys | seaweedfs | 7.2 (v4.0) | High |
| CVE-2026-6020 | ShopLentor <= 3.3.7 - Authenticated (Administrator+) Arbitrary Function Execution via 'callback' Parameter via REST API | ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin | 7.2 (v3.1) | High |
| CVE-2026-81669 | IBM Guardium Data Protection is affected by multiple vulnerabilities. | guardium data protection | 7.2 (v3.1) | High |
| CVE-2026-85160 | AVideo through c91b5975d CSRF and Path Traversal via stopLive.php | AVideo | 7.2 (v4.0) | High |
| CVE-2026-96896 | Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request | Malcure Malware Shield — Removal, Repair, Monitor | 7.2 (v3.1) | High |
| CVE-2026-9777 | ATEN Unizon restoreDB Directory Traversal Remote Code Execution Vulnerability | unizon | 7.2 (v3.0) | High |
| CVE-2018-25393 | Navigate CMS 2.8.5 Path Traversal via navigate_download.php | Navigate CMS | 7.1 (v4.0) | High |
| CVE-2018-25421 | Open STA Manager 2.3 Arbitrary File Download via Path Traversal | Open STA Manager | 7.1 (v4.0) | High |
| CVE-2019-25246 | BEWARD N100 H.264 VGA IP Camera M2.1.6 - Arbitrary File Disclosure | N100 H.264 VGA IP Camera | 7.1 (v4.0) | High |
| CVE-2022-51025 | Penta Security WAPPLES 4.0.54.1 / 5.0 / 6.0 Path Traversal via /webapi/file/transfer | WAPPLES | 7.1 (v4.0) | High |
| CVE-2024-58386 | ZoneMinder 1.37.x Path Traversal via files view | zoneminder | 7.1 (v4.0) | High |
| CVE-2025-39664 | Path-Traversal in report scheduler | checkmk | 7.1 (v4.0) | High |
| CVE-2026-107362 | Server-Side Request Forgery in Malcolm | Malcolm | 7.1 (v3.1) | High |
| CVE-2026-108158 | plugNmeet Server through 2.5.2 Path Traversal via /api/whiteboard/convert | plugNmeet-server | 7.1 (v4.0) | High |
| CVE-2026-22664 | prompts.chat SSRF via Fal.ai Media Status Polling | prompts.chat | 7.1 (v4.0) | High |
| CVE-2026-34414 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload | xerteonlinetoolkits | 7.1 (v4.0) | High |
| CVE-2026-34790 | Endian Firewall /cgi-bin/backup.cgi remove ARCHIVE Directory Traversal | firewall community | 7.1 (v4.0) | High |
| CVE-2026-39308 | PraisonAI recipe registry publish path traversal allows out-of-root file write | praisonai | 7.1 (v3.1) | High |
| CVE-2026-40160 | PraisonAIAgents has SSRF via unvalidated URL in web_crawl httpx fallback | praisonaiagents | 7.1 (v4.0) | High |
| CVE-2026-40526 | Volmarg Personal Management System Path Traversal via get-file Endpoint | personal-management-system | 7.1 (v4.0) | High |
| CVE-2026-41272 | Flowise: SSRF Protection Bypass (TOCTOU & Default Insecure) | flowise | 7.1 (v3.1) | High |
| CVE-2026-45725 | compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path Traversal | compliance-trestle | 7.1 (v4.0) | High |
| CVE-2026-46555 | WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration | whatsapp mcp server | 7.1 (v3.1) | High |
| CVE-2026-47118 | Agent Zero < 1.15 Path Traversal File Read via image_get API | agent-zero | 7.1 (v4.0) | High |
| CVE-2026-54077 | ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users | arcadedb | 7.1 (v3.1) | High |
| CVE-2026-56394 | Craft CMS - Authenticated Path Traversal in assets/icon Extension Parameter | cms | 7.1 (v4.0) | High |
| CVE-2026-57303 | assembla Server-Side Request Forgery Vulnerability | assembla | 7.1 (v3.1) | High |
| CVE-2026-63445 | Perses: Unvalidated project parameter enables filesystem path traversal | perses | 7.1 (v4.0) | High |
| CVE-2026-64826 | rConfig < 8.2.13 Path Traversal File Read via FileDownloadController | rConfig | 7.1 (v4.0) | High |
| CVE-2026-71426 | GetSimple CMS: Authenticated Stored Local File Inclusion (LFI) via page "template" field | GetSimpleCMS-CE | 7.1 (v4.0) | High |
| CVE-2026-75844 | ArcadeDB before 26.8.1 SSRF via IMPORT DATABASE validator bypass | arcadedb | 7.1 (v4.0) | High |
| CVE-2026-76210 | phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export | phpmyfaq | 7.1 (v4.0) | High |
| CVE-2026-79747 | MCPHub vulnerable to SSRF: a non-admin user can make mcphub request arbitrary URLs and read the response (OpenAPI proxy | mcphub | 7.1 (v3.1) | High |
| CVE-2026-81030 | Mage AI through 0.9.79 Arbitrary File Read via Unvalidated Path in browser_items Endpoint | mage-ai | 7.1 (v4.0) | High |
| CVE-2026-85164 | WWBN AVideo Server-Side Request Forgery via set_api_userImages | AVideo | 7.1 (v4.0) | High |
| CVE-2026-92804 | Nango through 0.70.4 Server-Side Request Forgery via Configuration | Nango | 7.1 (v4.0) | High |
| CVE-2026-93014 | RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter | RosarioSIS | 7.1 (v4.0) | High |
| CVE-2026-9587 | Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal | Switchvox SMB Edition | 7.1 (v4.0) | High |
| CVE-2026-96651 | Plex Media Server path traversal | media server | 7.1 (v4.0) | High |
| CVE-2026-10107 | MoviePilot v2 SSRF via /api/v1/system/img/{proxy} Endpoint | MoviePilot | 7.0 (v4.0) | High |
| CVE-2026-101898 | Axios: HTTP/2 adapter bypasses configured DNS lookup and proxy controls | axios | 7.0 (v4.0) | High |
| CVE-2026-114399 | Trudesk through 1.2.11 Path Traversal via Backup Delete and Restore API | trudesk | 7.0 (v4.0) | High |
| CVE-2026-114492 | gin-vue-admin through 2.9.2 Path Traversal via removePlugin Endpoint | gin-vue-admin | 7.0 (v4.0) | High |
| CVE-2026-40506 | OpenEMR Path Traversal Arbitrary Directory Deletion via standard_tables_manage.php | openemr | 7.0 (v4.0) | High |
| CVE-2026-52835 | Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database | Tautulli | 7.0 (v4.0) | High |
| CVE-2026-54134 | OctoPrint: File exfiltration possible via query parameters on upload endpoints | OctoPrint | 7.0 (v4.0) | High |
| CVE-2026-73033 | Sucuri WordPress Plugin 2.7.3 Path Traversal via integrity.lib.php | sucuri-wordpress-plugin | 7.0 (v4.0) | High |
| CVE-2026-74031 | Wazuh 4.1.1 before 4.14.8 Path Traversal File Deletion via Rule/Decoder Delete Helpers | wazuh-manager | 7.0 (v4.0) | High |
| CVE-2019-25760 | Joomla! Component Easy Shop 1.2.3 Local File Inclusion | easy shop | 6.9 (v4.0) | Medium |
| CVE-2022-50954 | WordPress Plugin cab-fare-calculator 1.0.3 Local File Inclusion | cab-fare-calculator | 6.9 (v4.0) | Medium |
| CVE-2022-50956 | WordPress Plugin amministrazione-aperta 3.7.3 Local File Read | amministrazione-aperta | 6.9 (v4.0) | Medium |
| CVE-2023-30804 | Sangfor Next-Gen Application Firewall Authenticated File Disclosure | next-gen application firewall | 6.9 (v4.0) | Medium |
| CVE-2024-12987 | DrayTek Vigor - Command Injection | Vigor300B | 6.9 (v4.0) | Medium |
| CVE-2025-11864 | NucleoidAI Nucleoid Outbound Request cluster.ts extension.apply server-side request forgery | Nucleoid | 6.9 (v4.0) | Medium |
| CVE-2025-1743 | Pichome 2.1.0 - Arbitrary File Read | Pichome | 6.9 (v4.0) | Medium |
| CVE-2025-34282 | ThingsBoard < v4.2.1 SVG Image SSRF | thingsboard | 6.9 (v4.0) | Medium |
| CVE-2026-100601 | ClawHub SSRF via Unchecked DNS Resolution in Profile Image | clawhub | 6.9 (v4.0) | Medium |
| CVE-2026-104440 | YesWiki before 4.6.7 Blind SSRF via bazarlist API idtypeannonce Parameter | yeswiki | 6.9 (v4.0) | Medium |
| CVE-2026-104441 | YesWiki before 4.6.7 Unauthenticated SSRF via valeur Action | yeswiki | 6.9 (v4.0) | Medium |
| CVE-2026-104442 | YesWiki before 4.6.7 Unauthenticated SSRF via syndication Action | yeswiki | 6.9 (v4.0) | Medium |
| CVE-2026-108850 | Company Research Agent through 2.2.0 SSRF via /generate-pdf ReportLab Markup | company-research-agent | 6.9 (v4.0) | Medium |
| CVE-2026-109309 | SiYuan v3.7.0 before v3.8.6 Arbitrary File Read via Plugin ResponseFile.Path | siyuan | 6.9 (v4.0) | Medium |
| CVE-2026-110222 | Razorpay IFSC Ruby gem through 2.0.62 SSRF via IFSC lookup | IFSC | 6.9 (v4.0) | Medium |
| CVE-2026-111053 | FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists | FOSSBilling | 6.9 (v4.0) | Medium |
| CVE-2026-111662 | Chaskiq through 2.0.3 Unauthenticated SSRF via /oembed Endpoint | chaskiq | 6.9 (v4.0) | Medium |
| CVE-2026-111720 | fish-island-backend through commit 7c61b78 SSRF via /api/web/parse | fish-island-backend | 6.9 (v4.0) | Medium |
| CVE-2026-112267 | SGLang through 0.5.22 SSRF via bootstrap_host and bootstrap_port on Decode Worker | sglang | 6.9 (v4.0) | Medium |
| CVE-2026-116205 | YesWiki before 4.7.0 Unauthenticated SSRF via [[|URL]] Raw-Inclusion Syntax | yeswiki | 6.9 (v4.0) | Medium |
| CVE-2026-116253 | DedeCMS Advertisement Rendering ad_js.php _RunMagicQuotes code injection | DedeCMS | 6.9 (v4.0) | Medium |
| CVE-2026-19983 | GL.iNet XE3000 NAS Command Service gl_nas_sys os command injection | A1300 | 6.9 (v4.0) | Medium |
| CVE-2026-23483 | Blinko <= 1.8.3 - Path Traversal via /plugins | blinko | 6.9 (v4.0) | Medium |
| CVE-2026-29059 | Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal | windmill | 6.9 (v4.0) | Medium |
| CVE-2026-34964 | Adminer before 5.5.0 SSRF via PDO DSN Injection | adminer | 6.9 (v4.0) | Medium |
| CVE-2026-41459 | Xerte Online Toolkits Arbitrary File Upload - Unauthenticated Media Upload | xerteonlinetoolkits | 6.9 (v4.0) | Medium |
| CVE-2026-41917 | OpenKM 6.3.12 Local File Inclusion via Admin Scripting | OpenKM Community Edition | 6.9 (v4.0) | Medium |
| CVE-2026-42888 | Audiobookshelf: Path Traversal vulnerability in the audiobookshelf project | audiobookshelf | 6.9 (v4.0) | Medium |
| CVE-2026-44652 | SillyTavern: SSRF vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium |
| CVE-2026-45774 | compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path Traversal | compliance-trestle | 6.9 (v4.0) | Medium |
| CVE-2026-46337 | WWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in view/img/image404Raw.php | avideo | 6.9 (v4.0) | Medium |
| CVE-2026-54150 | next-video: Unauthenticated arbitrary file read via /api/video request handler | next-video | 6.9 (v4.0) | Medium |
| CVE-2026-54885 | Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetching | boruta | 6.9 (v4.0) | Medium |
| CVE-2026-59809 | SiYuan before v3.8.0 Secret Exfiltration via http_request URL | siyuan | 6.9 (v4.0) | Medium |
| CVE-2026-61793 | Nuxt OG Image has unauthenticated SSRF via fonts[].path URL parameter | og-image | 6.9 (v4.0) | Medium |
| CVE-2026-63096 | Dendrite 0.13.8 SSRF via Unauthenticated Legacy Media Download Endpoint | dendrite | 6.9 (v4.0) | Medium |
| CVE-2026-71932 | DrayTek VigorSwitch Multiple Models Path Traversal via getSyslogFile | VigorSwitch G2540xs | 6.9 (v4.0) | Medium |
| CVE-2026-73058 | stoatchat before 0.15.0 SSRF via IPv6 unspecified address bypass | stoatchat | 6.9 (v4.0) | Medium |
| CVE-2026-74235 | GFI Exinda AI / ClearView < 7.6.5 Path Traversal via Configuration Download Handler | GFI Exinda AI | 6.9 (v4.0) | Medium |
| CVE-2026-75592 | Kirby: Access to image files outside of the site root via path traversal in the media handling | kirby | 6.9 (v4.0) | Medium |
| CVE-2026-79743 | MCPHub: Path Traversal via Malicious MCPB Manifest Name | mcphub | 6.9 (v4.0) | Medium |
| CVE-2026-79773 | Winter CMS before 1.2.13 Local File Inclusion via JavaScript | winter | 6.9 (v4.0) | Medium |
| CVE-2026-79781 | rclone serve s3 Path Traversal via dot-dot object keys | rclone | 6.9 (v4.0) | Medium |
| CVE-2026-81678 | AVideo SSRF Guard Bypass via IPv6 Transition Addresses | AVideo | 6.9 (v4.0) | Medium |
| CVE-2026-85609 | Openpanel before 2.3.0 SSRF via Site Checker Endpoint | openpanel | 6.9 (v4.0) | Medium |
| CVE-2026-86806 | opengeos GeoLibre _is_within_roots server-side request forgery | GeoLibre | 6.9 (v4.0) | Medium |
| CVE-2026-8712 | Wyoming < 1.10.2 SSRF via uri Query Parameter | wyoming | 6.9 (v4.0) | Medium |
| CVE-2026-88940 | knowns through 0.33.0 Arbitrary Directory Enumeration via workspace browse endpoint | knowns | 6.9 (v4.0) | Medium |
| CVE-2026-91081 | Docs through 5.6.1 SSRF via Unauthenticated cors-proxy Endpoint | docs | 6.9 (v4.0) | Medium |
| CVE-2026-91966 | AVideo through 29.0 Unauthenticated SSRF via Host Header | AVideo | 6.9 (v4.0) | Medium |
| CVE-2008-2650 | CMSimple 3.1 - Local File Inclusion | cmsimple | 6.8 (v2.0) | Medium |
| CVE-2008-6172 | Joomla! Component RWCards 3.0.11 - Local File Inclusion | rwcards | 6.8 (v2.0) | Medium |
| CVE-2009-3053 | Joomla! Agora 3.0.0b - Local File Inclusion | Joomla! | 6.8 (v2.0) | Medium |
| CVE-2010-1056 | Joomla! Component com_rokdownloads - Local File Inclusion | com rokdownloads | 6.8 (v2.0) | Medium |
| CVE-2010-1219 | Joomla! Component com_janews - Local File Inclusion | com janews | 6.8 (v2.0) | Medium |
| CVE-2010-1469 | Joomla! Component JProject Manager 1.0 - Local File Inclusion | com jprojectmanager | 6.8 (v2.0) | Medium |
| CVE-2010-1473 | Joomla! Component Advertising 0.25 - Local File Inclusion | com advertising | 6.8 (v2.0) | Medium |
| CVE-2010-1474 | Joomla! Component Sweetykeeper 1.5 - Local File Inclusion | com sweetykeeper | 6.8 (v2.0) | Medium |
| CVE-2010-1475 | Joomla! Component Preventive And Reservation 1.0.5 - Local File Inclusion | com preventive | 6.8 (v2.0) | Medium |
| CVE-2010-1476 | Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion | com alphauserpoints | 6.8 (v2.0) | Medium |
| CVE-2010-1478 | Joomla! Component Jfeedback 1.2 - Local File Inclusion | com jfeedback | 6.8 (v2.0) | Medium |
| CVE-2010-1607 | Joomla! Component WMI 1.5.0 - Local File Inclusion | com wmi | 6.8 (v2.0) | Medium |
| CVE-2010-1715 | Joomla! Component Online Exam 1.5.0 - Local File Inclusion | com onlineexam | 6.8 (v2.0) | Medium |
| CVE-2010-1718 | Joomla! Component Archery Scores 1.0.6 - Local File Inclusion | com archeryscores | 6.8 (v2.0) | Medium |
| CVE-2010-1719 | Joomla! Component MT Fire Eagle 1.2 - Local File Inclusion | com mtfireeagle | 6.8 (v2.0) | Medium |
| CVE-2010-1722 | Joomla! Component Online Market 2.x - Local File Inclusion | com market | 6.8 (v2.0) | Medium |
| CVE-2010-1723 | Joomla! Component iNetLanka Contact Us Draw Root Map 1.1 - Local File Inclusion | com drawroot | 6.8 (v2.0) | Medium |
| CVE-2010-1979 | Joomla! Component Affiliate Datafeeds 880 - Local File Inclusion | com datafeeds | 6.8 (v2.0) | Medium |
| CVE-2010-1981 | Joomla! Component Fabrik 2.0 - Local File Inclusion | fabrik | 6.8 (v2.0) | Medium |
| CVE-2010-2122 | Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval | com simpledownload | 6.8 (v2.0) | Medium |
| CVE-2010-2507 | Joomla! Component Picasa2Gallery 1.2.8 - Local File Inclusion | com picasa2gallery | 6.8 (v2.0) | Medium |
| CVE-2010-2680 | Joomla! Component jesectionfinder - Local File Inclusion | com jesectionfinder | 6.8 (v2.0) | Medium |
| CVE-2010-2857 | Joomla! Component Music Manager - Local File Inclusion | com music | 6.8 (v2.0) | Medium |
| CVE-2010-2920 | Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion | com foobla suggestions | 6.8 (v2.0) | Medium |
| CVE-2010-4617 | Joomla! Component JotLoader 2.2.1 - Local File Inclusion | com jotloader | 6.8 (v2.0) | Medium |
| CVE-2011-2744 | Chyrp 2.x - Local File Inclusion | chyrp | 6.8 (v2.0) | Medium |
| CVE-2012-0392 | Apache Struts2 S2-008 RCE | struts | 6.8 (v2.0) | Medium |
| CVE-2014-2383 | Dompdf < v0.6.0 - Local File Inclusion | dompdf | 6.8 (v2.0) | Medium |
| CVE-2022-28810 | ManageEngine ADSelfService Plus Custom Script Execution | manageengine adselfservice plus | 6.8 (v3.1) | Medium |
| CVE-2025-8385 | Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read | Zombify | 6.8 (v3.1) | Medium |
| CVE-2026-102354 | BentoPDF: SSRF via DNS Rebinding (TOCTOU) in Cloudflare CORS Proxy Worker | bentopdf | 6.8 (v3.1) | Medium |
| CVE-2026-63334 | draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist | drawio | 6.8 (v3.1) | Medium |
| CVE-2026-71475 | Insights-client-rhel9: insights-client: spoke-controlled clusterid injected unencoded into insights api url path | advanced cluster management for kubernetes | 6.8 (v3.1) | Medium |
| CVE-2026-79761 | Termix: Command injection in SSH key deployment verification | Termix | 6.6 (v3.1) | Medium |
| CVE-2016-6435 | Cisco Firepower Management Console 6.0 Post Auth Report Download Directory Traversal | secure firewall management center | 6.5 (v3.0) | Medium |
| CVE-2017-14537 | Trixbox 2.8.0 - Path Traversal | trixbox | 6.5 (v3.1) | Medium |
| CVE-2017-18357 | Shopware createInstanceFromNamedArguments PHP Object Instantiation RCE | shopware | 6.5 (v3.0) | Medium |
| CVE-2017-9416 | Odoo 8.0/9.0/10.0 - Local File Inclusion | odoo | 6.5 (v3.0) | Medium |
| CVE-2018-18778 | ACME mini_httpd Arbitrary File Read (CVE-2018-18778) | mini-httpd | 6.5 (v3.0) | Medium |
| CVE-2018-3714 | node-srv - Local File Inclusion | node-srv | 6.5 (v3.1) | Medium |
| CVE-2019-11013 | Nimble Streamer <=3.5.4-9 - Local File Inclusion | nimble streamer | 6.5 (v3.0) | Medium |
| CVE-2019-14312 | Aptana Jaxer 1.0.3.4547 - Local File inclusion | jaxer | 6.5 (v3.0) | Medium |
| CVE-2019-3799 | Spring Cloud Config Server - Local File Inclusion | spring cloud config | 6.5 (v3.1) | Medium |
| CVE-2019-8943 | WordPress Crop-image Shell Upload | WordPress | 6.5 (v3.1) | Medium |
| CVE-2021-24947 | WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read | responsive vector maps | 6.5 (v3.1) | Medium |
| CVE-2021-28149 | Hongdian H8922 3.0.5 Devices - Local File Inclusion | h8922 firmware | 6.5 (v3.1) | Medium |
| CVE-2021-29006 | rConfig 3.9.6 - Local File Inclusion | rconfig | 6.5 (v3.1) | Medium |
| CVE-2021-40651 | OS4Ed OpenSIS Community 8.0 - Local File Inclusion | opensis | 6.5 (v3.1) | Medium |
| CVE-2021-45839 | TerraMaster TOS 4.2.15 or lower - RCE chain from unauthenticated to root via session crafting. | tos | 6.5 (v3.1) | Medium |
| CVE-2022-37299 | Shirne CMS 1.2.0 - Local File Inclusion | shirne cms | 6.5 (v3.1) | Medium |
| CVE-2024-27564 | ChatGPT个人专用版 - Server Side Request Forgery | chatgpt web | 6.5 (v3.1) | Medium |
| CVE-2024-30851 | Jasmin Ransomware Web Server Unauthenticated Directory Traversal | jasmin-ransomware | 6.5 (v3.1) | Medium |
| CVE-2024-34319 | Server-Side Request Forgery | - | 6.5 (v3.1) | Medium |
| CVE-2024-36527 | Puppeteer Renderer - Directory Traversal | - | 6.5 (v3.1) | Medium |
| CVE-2024-55457 | MasterSAM Star Gate v11 - Local File Inclusion | - | 6.5 (v3.1) | Medium |
| CVE-2024-9765 | EKC Tournament Manager WordPress plugin - Path Traversal | ekc tournament manager | 6.5 (v3.1) | Medium |
| CVE-2025-11372 | LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 6.5 (v3.1) | Medium |
| CVE-2025-11705 | Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitra | Anti-Malware Security and Brute-Force Firewall | 6.5 (v3.1) | Medium |
| CVE-2025-13380 | AI Engine for WordPress: ChatGPT, GPT Content Generator <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read | AI Engine for WordPress: ChatGPT, GPT Content Generator | 6.5 (v3.1) | Medium |
| CVE-2025-14545 | YML for Yandex Market < 5.0.26 - Shop Manager+ RCE via Feed Generation | YML for Yandex Market | 6.5 (v3.1) | Medium |
| CVE-2025-2292 | Xorcom CompletePBX Authenticated File Disclosure via Backup Download | completepbx | 6.5 (v3.1) | Medium |
| CVE-2025-45870 | LogicalDOC Enterprise up to and for v9.1.1 Path Traversal Vulnerability | - | 6.5 (v3.1) | Medium |
| CVE-2025-50234 | mccms Arbitrary Code Execution Vulnerability | mccms | 6.5 (v3.1) | Medium |
| CVE-2025-62424 | ClipBucket path traversal vulnerability in template editor allows arbitrary file read and write | clipbucket | 6.5 (v3.1) | Medium |
| CVE-2026-11442 | Allegra exportReport Directory Traversal Information Disclosure Vulnerability | Allegra | 6.5 (v3.0) | Medium |
| CVE-2026-114623 | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure | basercms | 6.5 (v3.1) | Medium |
| CVE-2026-115886 | MLflow: SSRF on unauthenticated MLflow servers via third-party scorer kwargs in the scorer invoke, register, and GenAI e | mlflow | 6.5 (v3.1) | Medium |
| CVE-2026-14470 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base compone | langflow | 6.5 (v3.1) | Medium |
| CVE-2026-15974 | sglang Server-Side Request Forgery Vulnerability | sglang | 6.5 (v3.1) | Medium |
| CVE-2026-30480 | LibreNMS 22.11.0-23-gd091788f2 Path Traversal Vulnerability | LibreNMS 22.11.0-23-gd091788f2 | 6.5 (v3.1) | Medium |
| CVE-2026-31978 | motionEye: Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint | motioneye | 6.5 (v3.1) | Medium |
| CVE-2026-34787 | Emlog: Local File Inclusion in plugin.php via unsanitized plugin parameter | emlog | 6.5 (v3.1) | Medium |
| CVE-2026-35718 | fd8136 firmware Path Traversal Vulnerability | fd8136 firmware | 6.5 (v3.1) | Medium |
| CVE-2026-41060 | AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL | avideo | 6.5 (v3.1) | Medium |
| CVE-2026-42181 | Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image | lemmy | 6.5 (v3.1) | Medium |
| CVE-2026-52607 | reportico-web <= 8.1.0 Path Traversal Vulnerability | reportico-web <= 8.1.0 | 6.5 (v3.1) | Medium |
| CVE-2026-62282 | OpenCVE: Server-Side Request Forgery (SSRF) in notifications | opencve | 6.5 (v3.1) | Medium |
| CVE-2026-73255 | Mongoose: Path traversal in SSI #include directives enables arbitrary file read | mongoose | 6.5 (v3.1) | Medium |
| CVE-2026-73573 | zimbra collaboration suite Path Traversal Vulnerability | zimbra collaboration suite | 6.5 (v3.1) | Medium |
| CVE-2026-73574 | zimbra collaboration suite Incorrect Resource Transfer Between Spheres Vulnerability | zimbra collaboration suite | 6.5 (v3.1) | Medium |
| CVE-2026-7542 | Slider Revolution 7.0 - 7.0.10 - Authenticated (Subscriber+) Sensitive Information Disclosure | Slider Revolution | 6.5 (v3.1) | Medium |
| CVE-2026-7646 | Langflow is affected by security vulnerabilities in Model Context Protocol features | langflow | 6.5 (v3.1) | Medium |
| CVE-2026-78851 | Grav CMS 2.0.3 through 2.0.6 Path Traversal Vulnerability | Grav CMS 2.0.3 through 2.0.6 | 6.5 (v3.1) | Medium |
| CVE-2026-88403 | nocobase v2.1.21 Server-Side Request Forgery Vulnerability | nocobase v2.1.21 | 6.5 (v3.1) | Medium |
| CVE-2026-93767 | Tainacan <= 1.3.0 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read via 'guid' Parameter | Tainacan | 6.5 (v3.1) | Medium |
| CVE-2026-9774 | ATEN Unizon updateLicense Directory Traversal Arbitrary File Deletion Vulnerability | unizon | 6.5 (v3.1) | Medium |
| CVE-2026-9775 | ATEN Unizon uploadSSL Directory Traversal Arbitrary File Deletion Vulnerability | unizon | 6.5 (v3.1) | Medium |
| CVE-2012-3153 | Oracle Forms and Reports Remote Code Execution | fusion middleware | 6.4 (v2.0) | Medium |
| CVE-2012-4940 | Axigen Arbitrary File Read and Delete | axigen free mail server | 6.4 (v2.0) | Medium |
| CVE-2026-79760 | Termix: Authenticated blind SSRF through notification channel test endpoints | Termix | 6.4 (v3.1) | Medium |
| CVE-2019-2557 | Oracle Application Testing Suite Post-Auth DownloadServlet Directory Traversal | application testing suite | 6.3 (v3.0) | Medium |
| CVE-2026-102783 | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 | Gridbox extension for Joomla | 6.3 (v4.0) | Medium |
| CVE-2026-102983 | Astro: Netlify Image CDN allowlist bypass enables SSRF | astro | 6.3 (v4.0) | Medium |
| CVE-2026-105125 | LaraDashboard before 1.4.8 Path Traversal via /api/translations/{lang} Endpoint | laradashboard | 6.3 (v4.0) | Medium |
| CVE-2026-110652 | ONLYOFFICE DocumentServer before 10.0.0 SSRF via downloadfile isInJwtToken Bypass | DocumentServer | 6.3 (v4.0) | Medium |
| CVE-2026-111171 | Web3.py 7.15.0 through 7.16.0 and 8.0.0b2 through 8.0.0 CCIP-Read SSRF Bypass | web3.py | 6.3 (v4.0) | Medium |
| CVE-2026-112947 | Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance | vite | 6.3 (v4.0) | Medium |
| CVE-2026-115717 | Frappe Builder before 1.36.1 SSRF via convert_to_webp | builder | 6.3 (v4.0) | Medium |
| CVE-2026-39365 | Vite has a Path Traversal in Optimized Deps .map Handling | vite | 6.3 (v4.0) | Medium |
| CVE-2026-42335 | MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy | MaxKB | 6.3 (v4.0) | Medium |
| CVE-2026-42344 | FastGPT: DNS rebinding TOCTOU bypass in isInternalAddress allows SSRF on all protected endpoints | FastGPT | 6.3 (v3.1) | Medium |
| CVE-2026-45626 | Arcane: OS Command Injection in Volume Browser ListDirectory via path query parameter | arcane | 6.3 (v3.1) | Medium |
| CVE-2026-54020 | Open WebUI: DNS Rebinding SSRF Bypass | open webui | 6.3 (v3.1) | Medium |
| CVE-2026-56769 | Huly Platform - Server-Side Request Forgery via /import Endpoint | platform | 6.3 (v4.0) | Medium |
| CVE-2026-56771 | NewsBlur < 14.5.0 - Server-Side Request Forgery via add_url Endpoint | NewsBlur | 6.3 (v4.0) | Medium |
| CVE-2026-63107 | LimeSurvey SSRF via REST API Survey Template Host Header | LimeSurvey | 6.3 (v4.0) | Medium |
| CVE-2026-65012 | InvokeAI < 6.13.7 Unauthenticated Directory Enumeration via scan_folder | InvokeAI | 6.3 (v4.0) | Medium |
| CVE-2026-67620 | Flowise 3.1.4 SSRF via fetch-links Endpoint Incomplete Deny-List | flowise | 6.3 (v4.0) | Medium |
| CVE-2026-72814 | actix-web before 0.6.10 Information Disclosure via Files | actix-web | 6.3 (v4.0) | Medium |
| CVE-2026-73530 | Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip() | flyto-core | 6.3 (v4.0) | Medium |
| CVE-2026-78886 | liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversal | TREK | 6.3 (v4.0) | Medium |
| CVE-2026-82044 | UTMStack < 11.2.16 Server-Side Request Forgery via downloadPdf | UTMStack | 6.3 (v4.0) | Medium |
| CVE-2026-85738 | TREK: SSRF Guard Bypass via IPv6 Transition Addresses (NAT64/6to4) | TREK | 6.3 (v3.1) | Medium |
| CVE-2026-91079 | Huly Platform through 0.7.426 SSRF via Print Service | platform | 6.3 (v4.0) | Medium |
| CVE-2026-29066 | TinaCMS - Path Traversal | tinacms | 6.2 (v3.1) | Medium |
| CVE-2025-34076 | Microweber CMS v1.2.10 Local File Inclusion (Authenticated) | microweber | 6.1 (v4.0) | Medium |
| CVE-2025-35053 | Newforma Info Exchange (NIX) arbitrary file read and delete | project center | 6.1 (v4.0) | Medium |
| CVE-2012-6081 | MoinMoin twikidraw Action Traversal File Upload | moinmoin | 6.0 (v2.0) | Medium |
| CVE-2026-1776 | Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read | camaleon cms | 6.0 (v4.0) | Medium |
| CVE-2026-41363 | OpenClaw 2026.2.6 < 2026.3.28 - Arbitrary File Read via Feishu upload_image Parameter | openclaw | 6.0 (v4.0) | Medium |
| CVE-2026-65698 | Void 1.3.4 Path Traversal via AI Agent File-Reading Tools | void | 6.0 (v4.0) | Medium |
| CVE-2026-66004 | BlenderMCP Path Traversal via download_polyhaven_asset API | blender-mcp | 6.0 (v4.0) | Medium |
| CVE-2025-41242 | Spring Framework Path Traversal via Jetty URI Parsing Inconsistency (CVE-2025-41242) | Spring Framework | 5.9 (v3.1) | Medium |
| CVE-2026-103061 | Path traversal in Gleam via unvalidated package application names | Gleam | 5.9 (v4.0) | Medium |
| CVE-2026-49244 | SFTPGo: Path confinement bypass in public browsable share partial ZIP download | sftpgo | 5.9 (v3.1) | Medium |
| CVE-2010-0467 | Joomla! Component CCNewsLetter - Local File Inclusion | com ccnewsletter | 5.8 (v3.1) | Medium |
| CVE-2025-11427 | WP Migrate Lite <= 2.7.6 - Unauthenticated Blind Server-Side Request Forgery | WP Migrate Lite – Migration Made Easy | 5.8 (v3.1) | Medium |
| CVE-2026-10526 | EmbedPress < 4.6.1 - Unauthenticated Blind SSRF | EmbedPress | 5.8 (v3.1) | Medium |
| CVE-2026-34981 | whisperX REST API: SSRF in download_from_url() — URL validation happens after HTTP request, extension bypass via .mp3 | whisperx rest api | 5.8 (v3.1) | Medium |
| CVE-2026-45709 | Mailpit has an incomplete fix for GHSA-6jxm: HTML check still permits SSRF to private/loopback/IMDS via missing IP-filte | mailpit | 5.8 (v3.1) | Medium |
| CVE-2026-47160 | Vaultwarden: Server-side request forgery (SSRF) via Icon Endpoint Decimal/Hex/Octal IP Bypass | vaultwarden | 5.8 (v3.1) | Medium |
| CVE-2026-48053 | Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset | kolibri | 5.8 (v3.1) | Medium |
| CVE-2026-55187 | Mailpit: Incomplete SSRF protection in Link Check API via IPv6 transition mechanisms (follow-up to CVE-2026-27808) | mailpit | 5.8 (v3.1) | Medium |
| CVE-2026-73243 | kkFileView: Unauthenticated SSRF via /addTask with fullfilename type-confusion bypass | kkFileView | 5.8 (v3.1) | Medium |
| CVE-2025-1035 | KLog Server - Path Traversal | KLog Server | 5.7 (v3.1) | Medium |
| CVE-2026-40605 | Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API | Tautulli | 5.7 (v4.0) | Medium |
| CVE-2026-44520 | Docling-Graph: SSRF via Missing Internal IP Validation in URLInputHandler | docling-graph | 5.7 (v3.1) | Medium |
| CVE-2015-1487 | Symantec Endpoint Protection Manager Authentication Bypass and Code Execution | endpoint protection manager | 5.5 (v2.0) | Medium |
| CVE-2018-13980 | Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion | zeta producer | 5.5 (v3.1) | Medium |
| CVE-2018-15536 | Responsive FileManager < 9.13.4 - Directory Traversal | responsive filemanager | 5.5 (v3.0) | Medium |
| CVE-2025-10091 | Jinher OA XML Type xml external entity reference | jinher oa | 5.5 (v4.0) | Medium |
| CVE-2025-10709 | Four-Faith Water Conservancy Informatization Platform historyDownload.do;otheruserLogin.do;getfile path traversal | water conservancy informatization | 5.5 (v4.0) | Medium |
| CVE-2025-10816 | Jinher OA XML text xml external entity reference | jinher oa | 5.5 (v4.0) | Medium |
| CVE-2025-11018 | Four-Faith Water Conservancy Informatization Platform download.do;usrlogout.do.do path traversal | water conservancy informatization | 5.5 (v4.0) | Medium |
| CVE-2025-11336 | Four-Faith Water Conservancy Informatization Platform download.do;otherlogout.do path traversal | Water Conservancy Informatization Platform | 5.5 (v4.0) | Medium |
| CVE-2025-11337 | Four-Faith Water Conservancy Informatization Platform download.do;othersusrlogout.do path traversal | Water Conservancy Informatization Platform | 5.5 (v4.0) | Medium |
| CVE-2025-13261 | lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal | lsfusion platform | 5.5 (v4.0) | Medium |
| CVE-2025-13262 | lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal | lsfusion platform | 5.5 (v4.0) | Medium |
| CVE-2025-13786 | taosir WTCMS index.php fetch code injection | wtcms | 5.5 (v4.0) | Medium |
| CVE-2025-13792 | Qualitor getResumo.php eval code injection | the file /html/st/stdeslocamento/request/getResumo.php | 5.5 (v4.0) | Medium |
| CVE-2025-13810 | jsnjfz WebStack-Guns KaptchaController.java renderPicture path traversal | webstack-guns | 5.5 (v4.0) | Medium |
| CVE-2025-15432 | yeqifu carRental com.yeqifu.sys.controller.FileController downloadShowFile.action downloadShowFile path traversal | carrental | 5.5 (v4.0) | Medium |
| CVE-2026-100893 | Privoce VoceChat Server open_graphic_parse Endpoint resource.rs fetch server-side request forgery | VoceChat Server | 5.5 (v4.0) | Medium |
| CVE-2026-100901 | athlon1600 youtube-downloader stream.php stream server-side request forgery | youtube-downloader | 5.5 (v4.0) | Medium |
| CVE-2026-100909 | OctoberCMS ResizeImages.php getSourcePathForResize server-side request forgery | the file modules/system/classes/ResizeImages.php | 5.5 (v4.0) | Medium |
| CVE-2026-101005 | October CMS SSRF Protection ResizeImages.php validateExternalImageHost server-side request forgery | October CMS | 5.5 (v4.0) | Medium |
| CVE-2026-101082 | PMWeb downloader.aspx path traversal | PMWeb | 5.5 (v4.0) | Medium |
| CVE-2026-103687 | rhukster dom-sanitizer SVG Sanitization DOMSanitizer.php url incomplete blacklist | dom-sanitizer | 5.5 (v4.0) | Medium |
| CVE-2026-105290 | feelec-yishu feelcrm-os getCurlData Endpoint GoogleController.class.php server-side request forgery | feelcrm-os | 5.5 (v4.0) | Medium |
| CVE-2026-10694 | SourceCodester Online Food Ordering System index.php include file inclusion | Online Food Ordering System | 5.5 (v4.0) | Medium |
| CVE-2026-108772 | bleenco abstruse Cache Endpoint download_cache.go filepath.Join path traversal | abstruse | 5.5 (v4.0) | Medium |
| CVE-2026-116256 | geesondog RhaPHP Mp Module Media Proxy Show.php image server-side request forgery | RhaPHP | 5.5 (v4.0) | Medium |
| CVE-2026-116602 | SourceCodester Online Food Ordering System delete.php unlink path traversal | Online Food Ordering System | 5.5 (v4.0) | Medium |
| CVE-2026-15204 | TOTOLINK X5000R OpenVPN Export cstecgi.cgi exportOvpn path traversal | X5000R | 5.5 (v4.0) | Medium |
| CVE-2026-16252 | Beijing Shenzhou Shihan Technology Multimedia Integrated Business Display System Staffshinel Ds.jsp sql injection | Multimedia Integrated Business Display System | 5.5 (v4.0) | Medium |
| CVE-2026-18646 | danpros HTMLy Author Name htmly.php path traversal | HTMLy | 5.5 (v4.0) | Medium |
| CVE-2026-18973 | heshengtao super-agent-party extension_proxy Route server.py sanitize_proxy_url server-side request forgery | super-agent-party | 5.5 (v4.0) | Medium |
| CVE-2026-19379 | EFM ipTIME AX8004M CGI Endpoint d.cgi popen os command injection | ipTIME AX8004M | 5.5 (v4.0) | Medium |
| CVE-2026-19753 | Model Context Protocol mcp-rdf-explorer MCP Server server.py explore_url server-side request forgery | mcp-rdf-explorer | 5.5 (v4.0) | Medium |
| CVE-2026-19827 | alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal | alldata | 5.5 (v4.0) | Medium |
| CVE-2026-41130 | Craft CMS has a host header injection leading to SSRF via resource-js endpoint | cms | 5.5 (v4.0) | Medium |
| CVE-2026-5333 | DefaultFuction Content-Management-System tools.php command injection | content management system | 5.5 (v4.0) | Medium |
| CVE-2026-54611 | InstantCMS has Remote Code Execution in package installer | icms2 | 5.5 (v3.1) | Medium |
| CVE-2026-55439 | Halo: Path Traversal in Backup Download Leads to Arbitrary File Read | halo | 5.5 (v3.1) | Medium |
| CVE-2026-6604 | modelscope agentscope Cloud Metadata Endpoint _openai_tools.py openai_audio_to_text server-side request forgery | agentscope | 5.5 (v4.0) | Medium |
| CVE-2026-6625 | moxi624 Mogu Blog v2 Picture Storage Service LocalFileServiceImpl.java LocalFileServiceImpl.uploadPictureByUrl server-si | Mogu Blog v2 | 5.5 (v4.0) | Medium |
| CVE-2026-68922 | MobSF: Arbitrary File Read via Path Traversal in ZIP Uploads | Mobile-Security-Framework-MobSF | 5.5 (v3.1) | Medium |
| CVE-2026-7059 | 666ghj MiroFish Query Parameter simulation.py get_simulation_posts path traversal | MiroFish | 5.5 (v4.0) | Medium |
| CVE-2026-7132 | code-projects Online Lot Reservation System download.php readfile path traversal | Online Lot Reservation System | 5.5 (v4.0) | Medium |
| CVE-2026-7147 | JoeCastrom mcp-chat-studio LLM Models API llm.js server-side request forgery | mcp-chat-studio | 5.5 (v4.0) | Medium |
| CVE-2026-7159 | douinc mkdocs-mcp-plugin server.py list_documents path traversal | mkdocs-mcp-plugin | 5.5 (v4.0) | Medium |
| CVE-2026-7178 | ChatGPTNextWeb NextChat Artifacts Endpoint route.ts storeUrl server-side request forgery | nextchat | 5.5 (v4.0) | Medium |
| CVE-2026-7221 | TencentCloudBase CloudBase-MCP open-url API Endpoint interactive-server.ts openUrl server-side request forgery | CloudBase-MCP | 5.5 (v4.0) | Medium |
| CVE-2026-7271 | DV0x creative-ad-agent creative-ad-agent-server sdk-server.ts path traversal | creative-ad-agent | 5.5 (v4.0) | Medium |
| CVE-2026-7519 | Fujian Apex LiveBOS Endpoint UploadImage.do path traversal | LiveBOS | 5.5 (v4.0) | Medium |
| CVE-2026-76795 | AeternaLabsHQ PullMD REST API Endpoint api server-side request forgery | PullMD | 5.5 (v4.0) | Medium |
| CVE-2026-7698 | Tiandy Easy7 Integrated Management Platform updateDbBackupInfo os command injection | Easy7 Integrated Management Platform | 5.5 (v4.0) | Medium |
| CVE-2026-82598 | SeaCMS Template search.php parseIf code injection | SeaCMS | 5.5 (v4.0) | Medium |
| CVE-2026-82801 | NASA earthdata-search scale Endpoint handler.js scaleImage server-side request forgery | earthdata-search | 5.5 (v4.0) | Medium |
| CVE-2026-84441 | Piwigo Image Derivative i.php path traversal | Piwigo | 5.5 (v4.0) | Medium |
| CVE-2026-85380 | light0011 cms UEditor controller.php catchimage server-side request forgery | cms | 5.5 (v4.0) | Medium |
| CVE-2026-8755 | fishaudio Bert-VITS2 Model hiyoriUI.py _get_all_models path traversal | Bert-VITS2 | 5.5 (v4.0) | Medium |
| CVE-2026-94038 | NonceGeek dim-sum-app Deno Backend main.tsx textSearchV2Handler server-side request forgery | dim-sum-app | 5.5 (v4.0) | Medium |
| CVE-2026-9474 | yashpokharna2555 StudentManagementSystem studentdel.php confirm_logged_in sql injection | StudentManagementSystem | 5.5 (v4.0) | Medium |
| CVE-2026-96898 | yhx070424 ShopXO Ueditor Upload ueditor.php path traversal | ShopXO | 5.5 (v4.0) | Medium |
| CVE-2026-114620 | Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF | authlib | 5.4 (v3.1) | Medium |
| CVE-2026-17621 | Langflow OSS is affected by arbitrary file read due to path traversal vulnerabilities in file and knowledge base compone | langflow | 5.4 (v3.1) | Medium |
| CVE-2026-48483 | TypeBot's WhatsApp status forwarding uses unvalidated user-controlled URLs, allowing SSRF from the Typebot server | typebot.io | 5.4 (v3.1) | Medium |
| CVE-2026-54613 | Vvveb: Path Traversal in Revision Backup Reader/Deleter via Unsanitized theme Parameter | Vvveb | 5.4 (v3.1) | Medium |
| CVE-2026-7798 | FluentCRM <= 2.9.87 - Unauthenticated Blind Server-Side Request Forgery via 'SubscribeURL' Parameter | FluentCRM – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution | 5.4 (v3.1) | Medium |
| CVE-2014-8676 | SO Planning 1.32 - Multiple Vulnerabilities | soplanning | 5.3 (v3.0) | Medium |
| CVE-2014-9609 | Netsweeper 4.0.8 - Directory Traversal | netsweeper | 5.3 (v3.1) | Medium |
| CVE-2015-5471 | Swim Team <= v1.44.10777 - Local File Inclusion | swim team | 5.3 (v3.0) | Medium |
| CVE-2020-11798 | Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal | micollab audio, web & video conferencing | 5.3 (v3.1) | Medium |
| CVE-2020-13886 | Intelbras TIP 200/200 LITE/300 - Local File Inclusion | tip200 firmware | 5.3 (v3.1) | Medium |
| CVE-2021-23241 | MERCUSYS Mercury X18G 1.0.5 Router - Local File Inclusion | mercury x18g firmware | 5.3 (v3.1) | Medium |
| CVE-2021-28377 | Joomla! ChronoForums 2.0.11 - Local File Inclusion | chronoforums | 5.3 (v3.1) | Medium |
| CVE-2023-41599 | JFinalCMS v5.0.0 - Directory Traversal | jfinalcms | 5.3 (v3.1) | Medium |
| CVE-2023-7299 | DataGear resolveSql sql injection | datagear | 5.3 (v4.0) | Medium |
| CVE-2025-10268 | Printcart Web to Print Product Designer for WooCommerce <= 2.4.8 - Unauthenticated Folder Content Disclosure via Path Tr | Printcart Web to Print Product Designer for WooCommerce | 5.3 (v3.1) | Medium |
| CVE-2025-11072 | Download Counter Button <= 1.8.6.7 - Unauthenticated Arbitrary File Download | MelAbu WP Download Counter Button | 5.3 (v3.1) | Medium |
| CVE-2025-11344 | ILIAS Certificate Import code injection | ilias | 5.3 (v4.0) | Medium |
| CVE-2025-31486 | Vite server.fs.deny Bypass - Local File Inclusion | vite | 5.3 (v3.1) | Medium |
| CVE-2025-35056 | Newforma Info Exchange (NIX) limited file read | project center | 5.3 (v4.0) | Medium |
| CVE-2025-4078 | Wangshen SecGate 3600 Path Traversal Vulnerability | SecGate 3600 | 5.3 (v4.0) | Medium |
| CVE-2026-107844 | Contao: Path traversal in the images controller | contao | 5.3 (v3.1) | Medium |
| CVE-2026-108585 | argocd-mcp through 0.9.0 Path Traversal via delete_application Tool | argocd-mcp | 5.3 (v4.0) | Medium |
| CVE-2026-109354 | LibreNMS before 26.9.0 Path Traversal via NFSen channel Parameter | librenms | 5.3 (v4.0) | Medium |
| CVE-2026-110254 | Dockhand before 1.0.45 SSRF via IPv6 Transition Address Bypass in ipCategory | dockhand | 5.3 (v4.0) | Medium |
| CVE-2026-110766 | Colanode Server through 0.4.7 Path Traversal via Avatar Download Route | colanode | 5.3 (v4.0) | Medium |
| CVE-2026-111635 | Helical Insight through 7.0.0 Path Traversal via /getExternalResource | helicalinsight | 5.3 (v4.0) | Medium |
| CVE-2026-113664 | ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test | apostrophe | 5.3 (v4.0) | Medium |
| CVE-2026-115411 | crawlseo before 0.2.4 Server-Side Request Forgery via Crawler | crawlseo | 5.3 (v4.0) | Medium |
| CVE-2026-115720 | Frappe Builder before 1.36.1 SSRF Guard Bypass via HTTP Redirect | builder | 5.3 (v4.0) | Medium |
| CVE-2026-11944 | openSIS Classic 9.3 - Authenticated path traversal in SentMail attachment download | opensis | 5.3 (v4.0) | Medium |
| CVE-2026-15932 | Support Genix Lite < 1.4.48 - Unauthenticated Arbitrary File Read via Path Traversal | Support Genix | 5.3 (v3.1) | Medium |
| CVE-2026-16536 | Simple Google Calendar Outlook Events Widget < 3.1.0 - Unauthenticated SSRF via calendar_id | Simple Google Calendar Outlook Events Widget | 5.3 (v3.1) | Medium |
| CVE-2026-19785 | francoisjacquet RosarioSIS Student Medical Medical.inc.php sql injection | RosarioSIS | 5.3 (v4.0) | Medium |
| CVE-2026-21726 | Loki Path Traversal - CVE-2021-36156 Bypass | loki | 5.3 (v3.1) | Medium |
| CVE-2026-29202 | cPanel Code Injection Vulnerability | cPanel | 5.3 (v4.0) | Medium |
| CVE-2026-33766 | AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints | avideo | 5.3 (v4.0) | Medium |
| CVE-2026-34523 | SillyTavern: Path traversal allows file existence oracle | sillytavern | 5.3 (v3.1) | Medium |
| CVE-2026-34967 | Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Write | adminer | 5.3 (v4.0) | Medium |
| CVE-2026-35583 | Emissary has a Path Traversal via Blacklist Bypass in Configuration API | emissary | 5.3 (v3.1) | Medium |
| CVE-2026-36726 | bookcars v8.3 Path Traversal Vulnerability | bookcars v8.3 | 5.3 (v3.1) | Medium |
| CVE-2026-3835 | Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access | Prevent Direct Access – Protect WordPress Files | 5.3 (v3.1) | Medium |
| CVE-2026-42028 | novaGallery: Unauthenticated Path Traversal in Album and Cached Image Routes Allows Reading Images Outside Gallery Root | novagallery | 5.3 (v3.1) | Medium |
| CVE-2026-44202 | OpenAM Authenticated Server-Side Request Forgery (SSRF) via /sessionservice | OpenAM | 5.3 (v4.0) | Medium |
| CVE-2026-44583 | Paymenter: Blind Unauthenticated SSRF on the Paypal gateway module | Paymenter | 5.3 (v3.1) | Medium |
| CVE-2026-49138 | Nanobot < 0.2.1 SSRF via web_fetch Tool Redirect Following | nanobot | 5.3 (v4.0) | Medium |
| CVE-2026-49342 | YARD static cache reads raw traversal paths before router sanitization | yard | 5.3 (v3.1) | Medium |
| CVE-2026-49345 | Mercator CVE Configuration Vulnerable to Server-Side Request Forgery (SSRF) | mercator | 5.3 (v4.0) | Medium |
| CVE-2026-54300 | @astrojs/netlify broadens Astro image.remotePatterns in Netlify Image CDN config | astro | 5.3 (v3.1) | Medium |
| CVE-2026-54508 | TREK: Blind SSRF via unvalidated redirect-following in Google/Naver list import and Maps URL resolution | TREK | 5.3 (v4.0) | Medium |
| CVE-2026-55156 | Token Optimizer MCP: Unauthenticated Path Traversal in Dashboard Session Log API Endpoints | token-optimizer-mcp | 5.3 (v3.1) | Medium |
| CVE-2026-56138 | Authenticated Path Traversal in AIL framework /objects/item/diff Allows Reading Gzip-Compressed Files | ail-framework | 5.3 (v4.0) | Medium |
| CVE-2026-59231 | Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs | Pentestify | 5.3 (v4.0) | Medium |
| CVE-2026-63730 | HyperDX < 2.31.0 SSRF via Webhook Test Endpoint | hyperdx | 5.3 (v4.0) | Medium |
| CVE-2026-64626 | AVideo Encoder downloadURL SSRF via unpinned retry fallback | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-74858 | jae-jae fetcher-mcp URL Validation security-credentials fetch_urls server-side request forgery | fetcher-mcp | 5.3 (v4.0) | Medium |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | Gitea | 5.3 (v3.1) | Medium |
| CVE-2026-84069 | WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php | WebFacing™ | 5.3 (v3.1) | Medium |
| CVE-2026-89247 | WWBN AVideo XML Injection via plugin/AD_Server/VMAP.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-92569 | Hippo4j through 1.5.0 SSRF via clientAddress Parameter | hippo4j | 5.3 (v4.0) | Medium |
| CVE-2026-93597 | ArcadeDB before 26.9.1 SSRF via IPv6 transition addresses | arcadedb | 5.3 (v4.0) | Medium |
| CVE-2026-96652 | Plex Media Server SSRF | media server | 5.3 (v4.0) | Medium |
| CVE-2026-96655 | Plex Media Server arbitrary-host SSRF | media server | 5.3 (v4.0) | Medium |
| CVE-2025-59751 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59752 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59753 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59754 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59759 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59773 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59774 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2026-105263 | Shaarli Admin Metadata Endpoint MetadataController.php MetadataController server-side request forgery | Shaarli | 5.1 (v4.0) | Medium |
| CVE-2026-110225 | Shaarli through 0.16.9 SSRF via Thumbnail Retrieval update-thumbnail Route | Shaarli | 5.1 (v4.0) | Medium |
| CVE-2026-19761 | DTStack Taier Upload Controller UploadController.java MultipartFile.getOriginalFilename path traversal | Taier | 5.1 (v4.0) | Medium |
| CVE-2026-19763 | DTStack Taier Cluster Creation ClusterController.java FileUtils.deleteDirectory path traversal | Taier | 5.1 (v4.0) | Medium |
| CVE-2026-42213 | SolidCAM-GPPL-IDE: Path traversal in inc directive enables file probing and NTLM-hash leak | SolidCAM-GPPL-IDE | 5.1 (v4.0) | Medium |
| CVE-2026-42336 | MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch | MaxKB | 5.1 (v4.0) | Medium |
| CVE-2026-63302 | Local File Inclusion in Quick.CMS | Quick.CMS | 5.1 (v4.0) | Medium |
| CVE-2006-3392 | Webmin File Disclosure | usermin | 5.0 (v2.0) | Medium |
| CVE-2007-4504 | Joomla! RSfiles <=1.0.2 - Local File Inclusion | rsfiles | 5.0 (v2.0) | Medium |
| CVE-2008-4764 | Joomla! <=2.0.0 RC2 - Local File Inclusion | com extplorer | 5.0 (v2.0) | Medium |
| CVE-2008-6080 | Joomla! ionFiles 4.4.2 - Local File Inclusion | com ionfiles | 5.0 (v2.0) | Medium |
| CVE-2008-6222 | Joomla! ProDesk 1.0/1.2 - Local File Inclusion | pro desk support center | 5.0 (v2.0) | Medium |
| CVE-2008-6668 | nweb2fax <=0.2.7 - Local File Inclusion | nweb2fax | 5.0 (v2.0) | Medium |
| CVE-2009-1496 | Joomla! Cmimarketplace 0.1 - Local File Inclusion | Joomla! | 5.0 (v2.0) | Medium |
| CVE-2009-2100 | Joomla! JoomlaPraise Projectfork 2.0.10 - Local File Inclusion | Joomla! | 5.0 (v2.0) | Medium |
| CVE-2009-5114 | WebGlimpse 2.18.7 - Directory Traversal | webglimpse | 5.0 (v2.0) | Medium |
| CVE-2010-0696 | Joomla! Component Jw_allVideos - Arbitrary File Retrieval | jw allvideos | 5.0 (v2.0) | Medium |
| CVE-2010-0942 | Joomla! Component com_jvideodirect - Directory Traversal | com jvideodirect | 5.0 (v2.0) | Medium |
| CVE-2010-0943 | Joomla! Component com_jashowcase - Directory Traversal | com jashowcase | 5.0 (v2.0) | Medium |
| CVE-2010-0944 | Joomla! Component com_jcollection - Directory Traversal | com jcollection | 5.0 (v2.0) | Medium |
| CVE-2010-1081 | Joomla! Component com_communitypolls 1.5.2 - Local File Inclusion | com communitypolls | 5.0 (v2.0) | Medium |
| CVE-2010-1302 | Joomla! Component DW Graph - Local File Inclusion | com dwgraphs | 5.0 (v2.0) | Medium |
| CVE-2010-1304 | Joomla! Component User Status - Local File Inclusion | com userstatus | 5.0 (v2.0) | Medium |
| CVE-2010-1305 | Joomla! Component JInventory 1.23.02 - Local File Inclusion | com jinventory | 5.0 (v2.0) | Medium |
| CVE-2010-1307 | Joomla! Component Magic Updater - Local File Inclusion | com joomlaupdater | 5.0 (v2.0) | Medium |
| CVE-2010-1308 | Joomla! Component SVMap 1.1.1 - Local File Inclusion | com svmap | 5.0 (v2.0) | Medium |
| CVE-2010-1312 | Joomla! Component News Portal 1.5.x - Local File Inclusion | com news portal | 5.0 (v2.0) | Medium |
| CVE-2010-1314 | Joomla! Component Highslide 1.5 - Local File Inclusion | com hsconfig | 5.0 (v2.0) | Medium |
| CVE-2010-1315 | Joomla! Component webERPcustomer - Local File Inclusion | com weberpcustomer | 5.0 (v2.0) | Medium |
| CVE-2010-1340 | Joomla! Component com_jresearch - 'Controller' Local File Inclusion | com jresearch | 5.0 (v2.0) | Medium |
| CVE-2010-1345 | Joomla! Component Cookex Agency CKForms - Local File Inclusion | com ckforms | 5.0 (v2.0) | Medium |
| CVE-2010-1352 | Joomla! Component Juke Box 1.7 - Local File Inclusion | com jukebox | 5.0 (v2.0) | Medium |
| CVE-2010-1353 | Joomla! Component LoginBox - Local File Inclusion | com loginbox | 5.0 (v2.0) | Medium |
| CVE-2010-1354 | Joomla! Component VJDEO 1.0 - Local File Inclusion | com vjdeo | 5.0 (v2.0) | Medium |
| CVE-2010-1461 | Joomla! Component Photo Battle 1.0.1 - Local File Inclusion | com photobattle | 5.0 (v2.0) | Medium |
| CVE-2010-1491 | Joomla! Component MMS Blog 2.3.0 - Local File Inclusion | com mmsblog | 5.0 (v2.0) | Medium |
| CVE-2010-1494 | Joomla! Component AWDwall 1.5.4 - Local File Inclusion | com awdwall | 5.0 (v2.0) | Medium |
| CVE-2010-1532 | Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion | com powermail | 5.0 (v2.0) | Medium |
| CVE-2010-1534 | Joomla! Component Shoutbox Pro - Local File Inclusion | com shoutbox | 5.0 (v2.0) | Medium |
| CVE-2010-1540 | Joomla! Component com_blog - Directory Traversal | com myblog | 5.0 (v2.0) | Medium |
| CVE-2010-1601 | Joomla! Component JA Comment - Local File Inclusion | com jacomment | 5.0 (v2.0) | Medium |
| CVE-2010-1657 | Joomla! Component SmartSite 1.0.0 - Local File Inclusion | com smartsite | 5.0 (v2.0) | Medium |
| CVE-2010-1658 | Joomla! Component NoticeBoard 1.3 - Local File Inclusion | com noticeboard | 5.0 (v2.0) | Medium |
| CVE-2010-1659 | Joomla! Component Ultimate Portfolio 1.0 - Local File Inclusion | com ultimateportfolio | 5.0 (v2.0) | Medium |
| CVE-2010-1714 | Joomla! Component Arcade Games 1.0 - Local File Inclusion | com arcadegames | 5.0 (v2.0) | Medium |
| CVE-2010-1858 | Joomla! Component SMEStorage - Local File Inclusion | com smestorage | 5.0 (v2.0) | Medium |
| CVE-2010-1982 | Joomla! Component JA Voice 2.0 - Local File Inclusion | com javoice | 5.0 (v2.0) | Medium |
| CVE-2010-2018 | Lokomedia CMS - Local File Inclusion | lokomedia cms | 5.0 (v2.0) | Medium |
| CVE-2010-2307 | Motorola SBV6120E SURFboard Digital Voice Modem SBV6X2X-1.0.0.5-SCM - Directory Traversal | surfboard sbv6120e | 5.0 (v2.0) | Medium |
| CVE-2011-0049 | Majordomo2 _list_file_get() Directory Traversal | majordomo 2 | 5.0 (v2.0) | Medium |
| CVE-2011-1669 | WP Custom Pages 0.5.0.1 - Local File Inclusion (LFI) | wp custom pages | 5.0 (v2.0) | Medium |
| CVE-2011-2780 | Chyrp 2.x - Local File Inclusion | chyrp | 5.0 (v2.0) | Medium |
| CVE-2011-4804 | Joomla! Component com_kp - 'Controller' Local File Inclusion | com obsuggest | 5.0 (v2.0) | Medium |
| CVE-2012-0896 | Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access | count per day | 5.0 (v2.0) | Medium |
| CVE-2012-0981 | phpShowtime 2.0 - Directory Traversal | phpshowtime | 5.0 (v2.0) | Medium |
| CVE-2012-0996 | 11in1 CMS 1.2.1 - Local File Inclusion (LFI) | 11in1 | 5.0 (v2.0) | Medium |
| CVE-2012-2983 | Webmin edit_html.cgi file Parameter Traversal Arbitrary File Access | webmin | 5.0 (v2.0) | Medium |
| CVE-2012-4347 | Symantec Messaging Gateway 9.5 Log File Download Vulnerability | messaging gateway | 5.0 (v2.0) | Medium |
| CVE-2012-5192 | Bitweaver overlay_type Directory Traversal | bitweaver | 5.0 (v2.0) | Medium |
| CVE-2013-2641 | Sophos Web Protection Appliance patience.cgi Directory Traversal | web appliance firmware | 5.0 (v2.0) | Medium |
| CVE-2013-3336 | ColdFusion 'password.properties' Hash Extraction | coldfusion | 5.0 (v2.0) | Medium |
| CVE-2013-4823 | HP Intelligent Management BIMS DownloadServlet Directory Traversal | intelligent management center | 5.0 (v2.0) | Medium |
| CVE-2013-4826 | HP Intelligent Management SOM FileDownloadServlet Arbitrary Download | imc service operation management software module | 5.0 (v2.0) | Medium |
| CVE-2013-5979 | Xibo 1.2.2/1.4.1 - Directory Traversal | xibo | 5.0 (v2.0) | Medium |
| CVE-2013-7091 | Zimbra Collaboration Server LFI | zimbra collaboration suite | 5.0 (v2.0) | Medium |
| CVE-2014-100002 | ManageEngine Support Center Plus Directory Traversal | manageengine supportcenter plus | 5.0 (v2.0) | Medium |
| CVE-2014-4577 | WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion | wp amasin - the amazon affiliate shop | 5.0 (v2.0) | Medium |
| CVE-2014-4940 | WordPress Plugin Tera Charts - Local File Inclusion | tera-charts | 5.0 (v2.0) | Medium |
| CVE-2014-4941 | Cross RSS 1.7 - Local File Inclusion | wp-cross-rss | 5.0 (v2.0) | Medium |
| CVE-2014-5111 | Fonality trixbox - Local File Inclusion | trixbox | 5.0 (v2.0) | Medium |
| CVE-2014-5181 | Last.fm Rotation 1.0 - Path Traversal | lastfm-rotation plugin | 5.0 (v2.0) | Medium |
| CVE-2014-5187 | Tom M8te (tom-m8te) Plugin 1.5.3 - Directory Traversal | tom-m8te plugin | 5.0 (v2.0) | Medium |
| CVE-2014-6308 | Osclass Security Advisory 3.4.1 - Local File Inclusion | osclass | 5.0 (v2.0) | Medium |
| CVE-2014-8799 | WordPress DukaPress Plugin File Read Vulnerability | dukapress | 5.0 (v2.0) | Medium |
| CVE-2015-0922 | McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure | epolicy orchestrator | 5.0 (v2.0) | Medium |
| CVE-2015-2067 | Magento Server MAGMI - Directory Traversal | magmi | 5.0 (v2.0) | Medium |
| CVE-2015-2166 | Ericsson Drutt MSDP - Local File Inclusion | drutt mobile service delivery platform | 5.0 (v2.0) | Medium |
| CVE-2015-2997 | SysAid Help Desk Arbitrary File Download | sysaid | 5.0 (v2.0) | Medium |
| CVE-2015-4414 | WordPress SE HTML5 Album Audio Player 1.1.0 - Directory Traversal | se html5 album audio player | 5.0 (v2.0) | Medium |
| CVE-2015-4666 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 5.0 (v2.0) | Medium |
| CVE-2015-5531 | ElasticSearch Arbitrary File Upload (WooYun-2015-110216) | elasticsearch | 5.0 (v2.0) | Medium |
| CVE-2015-5688 | Geddy <13.0.8 - Local File Inclusion | geddy | 5.0 (v2.0) | Medium |
| CVE-2025-11536 | Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery | Element Pack – Widgets, Templates & Addons for Elementor | 5.0 (v3.1) | Medium |
| CVE-2026-78850 | Matomo v.5.11.2 Information Disclosure Vulnerability | - | 5.0 (v3.1) | Medium |
| CVE-2017-7461 | Intellinet NFC-30IR Camera - Multiple Vulnerabilities | nfc-30ir firmware | 4.9 (v3.0) | Medium |
| CVE-2020-11491 | Zen Load Balancer Directory Traversal | zen load balancer | 4.9 (v3.1) | Medium |
| CVE-2023-34259 | Kyocera TASKalfa printer - Path Traversal | d-copia253mf plus firmware | 4.9 (v3.1) | Medium |
| CVE-2025-11466 | Allegra DatabaseBackupBL Directory Traversal Information Disclosure Vulnerability | Allegra | 4.9 (v3.0) | Medium |
| CVE-2025-67819 | weaviate Path Traversal Vulnerability | weaviate | 4.9 (v3.1) | Medium |
| CVE-2025-69904 | Linkstack 4.8.4 and Earlier Path Traversal Vulnerability | - | 4.9 (v3.1) | Medium |
| CVE-2026-17604 | Kirki <= 6.1.1 - Authenticated (Editor+) Path Traversal to Arbitrary File Read via 'data' Parameter | Kirki – Freeform Page Builder, Website Builder & Customizer | 4.9 (v3.1) | Medium |
| CVE-2026-25525 | OpenMage LTS has Path Traversal Filter Bypass in Dataflow Module | magento | 4.9 (v3.1) | Medium |
| CVE-2026-5114 | SpeedyCache <= 1.3.8 - Authenticated (Administrator+) Arbitrary File Read | SpeedyCache – Cache, Optimization, Performance | 4.9 (v3.1) | Medium |
| CVE-2026-53594 | FreeScout has Arbitrary File Read in App Logs Viewer via Forged Encrypted Path | freescout | 4.9 (v3.1) | Medium |
| CVE-2026-77825 | IBM ContextForge MCP Gateway is affected by path traversal | contextforge | 4.9 (v3.1) | Medium |
| CVE-2025-54292 | Client-Side Path Traversal in LXD-UI | lxd | 4.8 (v4.0) | Medium |
| CVE-2026-102332 | Dozzle before 11.1.2 Path Traversal via Log ZIP Download | dozzle | 4.6 (v4.0) | Medium |
| CVE-2025-13698 | Deciso OPNsense diag_backup.php filename Directory Traversal Arbitrary File Creation Vulnerability | OPNsense | 4.5 (v3.0) | Medium |
| CVE-2008-5587 | phpPgAdmin <=4.2.1 - Local File Inclusion | phppgadmin | 4.3 (v2.0) | Medium |
| CVE-2010-0982 | Joomla! Component com_cartweberp - Local File Inclusion | com cartweberp | 4.3 (v2.0) | Medium |
| CVE-2010-1217 | Joomla! Component & Plugin JE Tooltip 1.0 - Local File Inclusion | je form creator | 4.3 (v2.0) | Medium |
| CVE-2010-1313 | Joomla! Component Saber Cart 1.0.0.12 - Local File Inclusion | com sebercart | 4.3 (v2.0) | Medium |
| CVE-2012-4253 | MySQLDumper 1.24.4 - Directory Traversal | mysqldumper | 4.3 (v2.0) | Medium |
| CVE-2015-3337 | Elasticsearch - Local File Inclusion | elasticsearch | 4.3 (v2.0) | Medium |
| CVE-2018-18777 | Microstrategy Web 7 - Local File Inclusion | microstrategy web | 4.3 (v3.0) | Medium |
| CVE-2024-7631 | Openshift-console: openshift console: path traversal | Red Hat OpenShift Container Platform 3.11 | 4.3 (v3.1) | Medium |
| CVE-2026-113671 | ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated S | apostrophe | 4.3 (v3.1) | Medium |
| CVE-2026-12905 | Online Scheduling and Appointment Booking System – Bookly <= 27.7 - Authenticated (Staff+) Insecure Direct Object Refere | Online Scheduling and Appointment Booking System – Bookly | 4.3 (v3.1) | Medium |
| CVE-2026-26477 | dokuwiki Denial of Service Vulnerability | dokuwiki | 4.3 (v3.1) | Medium |
| CVE-2026-48789 | AnythingLLM: Windows path containment bypass in document folder route | anything-llm | 4.3 (v3.1) | Medium |
| CVE-2026-55495 | Cloudreve: Path Traversal in WOPI PUT_RELATIVE Allows Arbitrary File Creation in Owner Account | cloudreve | 4.3 (v3.1) | Medium |
| CVE-2026-59816 | Joplin: Path traversal in transcribe proxy endpoint via URL-encoded slash | joplin | 4.3 (v3.1) | Medium |
| CVE-2026-73657 | Trigger.dev: Cross-tenant payload poisoning via packet write + replay | trigger.dev | 4.2 (v3.1) | Medium |
| CVE-2011-4640 | WebTitan < 3.60 - Local File Inclusion | webtitan | 4.0 (v2.0) | Medium |
| CVE-2013-5528 | Cisco Unified Communications Manager 7/8/9 - Directory Traversal | unified communications manager | 4.0 (v2.0) | Medium |
| CVE-2014-2424 | Oracle Event Processing FileUploadServlet Arbitrary File Upload | fusion middleware | 4.0 (v2.0) | Medium |
| CVE-2014-5258 | webEdition 6.3.8.0 - Directory Traversal | webedition cms | 4.0 (v2.0) | Medium |
| CVE-2015-0921 | McAfee ePolicy Orchestrator Authenticated XXE Credentials Exposure | epolicy orchestrator | 4.0 (v2.0) | Medium |
| CVE-2019-19411 | Huawei Firewall - Local File Inclusion | usg9500 | 3.7 (v3.1) | Low |
| CVE-2012-0991 | OpenEMR 4.1 - Local File Inclusion | openemr | 3.5 (v2.0) | Low |
| CVE-2025-10583 | WP Fastest Cache Premium <= 1.7.4 - Missing Authorization to Authenticated (Subscriber+) Blind Server-Side Request Forge | WP Fastest Cache Premium | 3.5 (v3.1) | Low |
| CVE-2025-11990 | Improper Handling of URL Encoding (Hex Encoding) in GitLab | gitlab | 3.5 (v3.1) | Low |
| CVE-2025-55523 | Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download | agent-zero | 3.5 (v3.1) | Low |
| CVE-2026-113651 | ApostropheCMS: Path traversal in uploadfs | apostrophe | 3.3 (v3.1) | Low |
| CVE-2026-55825 | Contao: Possible path traversal in job download URIs | contao | 3.1 (v3.1) | Low |
| CVE-2026-49262 | Aimeos Pagible CMS vulnerable to Server Side Request Forgery (SSRF) via DNS rebinding in admin proxy | pagible | 3.0 (v3.1) | Low |
| CVE-2026-68927 | MobSF: SSRF port restriction bypass in assetlinks_check | Mobile-Security-Framework-MobSF | 3.0 (v3.1) | Low |
| CVE-2025-14276 | Ilevia EVE X1 Server leaf_search.php command injection | EVE X1 Server | 2.9 (v4.0) | Low |
| CVE-2023-2252 | Directorist < 7.5.4 - Local File Inclusion | directorist | 2.7 (v3.1) | Low |
| CVE-2025-10723 | PixelYourSite < 11.1.2 - Admin+ LFI | PixelYourSite | 2.7 (v3.1) | Low |
| CVE-2026-115730 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl | i18next-http-backend | 2.3 (v4.0) | Low |
| CVE-2026-115752 | Signal K Server 2.28.0-beta.2 before 2.34.0 SSRF via App Store appIcon | signalk-server | 2.3 (v4.0) | Low |
| CVE-2026-16434 | Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass | adminer | 2.3 (v4.0) | Low |
| CVE-2026-73087 | Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher | dozzle | 2.3 (v4.0) | Low |
| CVE-2026-41321 | @astrojs/cloudflare: SSRF via redirect following in Cloudflare image-binding-transform endpoint | @astrojs/cloudflare | 2.2 (v3.1) | Low |
| CVE-2025-10232 | 299ko FileManagerAPIController.php delete path traversal | the file plugin/filemanager/controllers/FileManagerAPIController.php | 2.1 (v4.0) | Low |
| CVE-2025-10233 | kalcaddle kodbox editor.class.php fileSave path traversal | kodbox | 2.1 (v4.0) | Low |
| CVE-2025-11034 | Dibo Data Decision Making System common_dep.action.jsp downloadImpTemplet path traversal | Data Decision Making System | 2.1 (v4.0) | Low |
| CVE-2025-11035 | Jinher OA text xml external entity reference | jinher oa | 2.1 (v4.0) | Low |
| CVE-2025-11490 | wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection | desktopcommandermcp | 2.1 (v4.0) | Low |
| CVE-2025-11631 | RainyGao DocSys deleteDoc.do path traversal | docsys | 2.1 (v4.0) | Low |
| CVE-2025-11902 | yanyutao0402 ChanCMS findField sql injection | chancms | 2.1 (v4.0) | Low |
| CVE-2025-11905 | yanyutao0402 ChanCMS gather.js getArticle code injection | chancms | 2.1 (v4.0) | Low |
| CVE-2025-11913 | Shenzhen Ruiming Technology Streamax Crocus Service.do download path traversal | streamax crocus | 2.1 (v4.0) | Low |
| CVE-2025-11914 | Shenzhen Ruiming Technology Streamax Crocus DeviceFileReport.do download path traversal | streamax crocus | 2.1 (v4.0) | Low |
| CVE-2025-11941 | e107 CMS Avatar image.php path traversal | e107 | 2.1 (v4.0) | Low |
| CVE-2025-12203 | givanz Vvveb Code Editor functions.php sanitizeFileName path traversal | vvveb | 2.1 (v4.0) | Low |
| CVE-2025-12266 | Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection | Central Authentication Service | 2.1 (v4.0) | Low |
| CVE-2025-12626 | jeecgboot jeewx-boot WxActGoldeneggsPrizesController.java getImgUrl path traversal | jeewx-boot | 2.1 (v4.0) | Low |
| CVE-2025-13174 | rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery | WeRSS we-mp-rss | 2.1 (v4.0) | Low |
| CVE-2025-14204 | TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command inje | cherry-studio-TykoFork | 2.1 (v4.0) | Low |
| CVE-2025-14518 | PowerJob Network Request PingPongUtils.java checkConnectivity server-side request forgery | powerjob | 2.1 (v4.0) | Low |
| CVE-2025-14520 | baowzh hfly delfile path traversal | hfly | 2.1 (v4.0) | Low |
| CVE-2025-14521 | baowzh hfly download path traversal | hfly | 2.1 (v4.0) | Low |
| CVE-2026-102244 | MODSetter SurfSense Document Export Feature editor_routes.py server-side request forgery | SurfSense | 2.1 (v4.0) | Low |
| CVE-2026-10239 | JeecgBoot edit WordUtil.addImage server-side request forgery | JeecgBoot | 2.1 (v4.0) | Low |
| CVE-2026-103540 | formtools.org Form Tools Client Settings Clients.class.php updateClientSettingsTab special elements in template engine | Form Tools | 2.1 (v4.0) | Low |
| CVE-2026-10558 | SourceCodester Pizzafy Ecommerce System index.php file inclusion | Pizzafy Ecommerce System | 2.1 (v4.0) | Low |
| CVE-2026-10559 | SourceCodester Pizzafy Ecommerce System index.php file inclusion | Pizzafy Ecommerce System | 2.1 (v4.0) | Low |
| CVE-2026-108791 | westboy CicadasCMS Template Management input TemplateController.input path traversal | CicadasCMS | 2.1 (v4.0) | Low |
| CVE-2026-108811 | WMCMS index.php information disclosure | WMCMS | 2.1 (v4.0) | Low |
| CVE-2026-108821 | Tencent WeKnora SQL Validator inject.go validateSubquery sql injection | WeKnora | 2.1 (v4.0) | Low |
| CVE-2026-109402 | conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery | conductor | 2.1 (v4.0) | Low |
| CVE-2026-112254 | agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery | clientst0r | 2.1 (v4.0) | Low |
| CVE-2026-112302 | kiwilan php-archive Extraction ArchiveZip.php extract path traversal | php-archive | 2.1 (v4.0) | Low |
| CVE-2026-113505 | aaPanel Download Endpoint v2.py send_file path traversal | aaPanel | 2.1 (v4.0) | Low |
| CVE-2026-11408 | vertex-app vertex Log Viewer Endpoint LogMod.js os command injection | vertex | 2.1 (v4.0) | Low |
| CVE-2026-114376 | leomoon-studios wiki-go API editor.go SourceHandler path traversal | wiki-go | 2.1 (v4.0) | Low |
| CVE-2026-116045 | 1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal | designer-mcp | 2.1 (v4.0) | Low |
| CVE-2026-116224 | fr0tt benotes Bookmark Metadata Endpoint PostController.php getUrlInfo server-side request forgery | benotes | 2.1 (v4.0) | Low |
| CVE-2026-12210 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery | python-utcp | 2.1 (v4.0) | Low |
| CVE-2026-12814 | Comfast CF-WR631AX V3 API Endpoint mbox-config system os command injection | CF-WR631AX V3 | 2.1 (v4.0) | Low |
| CVE-2026-14691 | SourceCodester Multi-Vendor Online Grocery Management System Setting SystemSettings.php update_settings_info code inject | Multi-Vendor Online Grocery Management System | 2.1 (v4.0) | Low |
| CVE-2026-14698 | SourceCodester Syllabus-Aligned Learning Management and Examination System upload_files.php unrestricted upload | Syllabus-Aligned Learning Management and Examination System | 2.1 (v4.0) | Low |
| CVE-2026-14783 | NousResearch hermes-agent skills_tool.py skill_view path traversal | hermes-agent | 2.1 (v4.0) | Low |
| CVE-2026-15138 | tumf mcp-text-editor text_editor.py _validate_file_path path traversal | mcp-text-editor | 2.1 (v4.0) | Low |
| CVE-2026-15500 | AstrBotDevs AstrBot market_list Endpoint plugin.py get_online_plugins server-side request forgery | AstrBot | 2.1 (v4.0) | Low |
| CVE-2026-15512 | pig-mesh Pig pig-codegen GeneratorServiceImpl.java code injection | Pig | 2.1 (v4.0) | Low |
| CVE-2026-15619 | mosaxiv clawlet IPv4 tool_web_fetch.go web_fetch server-side request forgery | clawlet | 2.1 (v4.0) | Low |
| CVE-2026-15620 | mosaxiv clawlet tool_web_fetch.go tools.webFetch server-side request forgery | clawlet | 2.1 (v4.0) | Low |
| CVE-2026-15628 | zhayujie chatgpt-on-wechat CowAgent Vision Tool vision.py Vision._download_to_data_url server-side request forgery | chatgpt-on-wechat CowAgent | 2.1 (v4.0) | Low |
| CVE-2026-15921 | nvm path traversal via a malicious mirror's LTS codename writes outside the alias directory | nvm | 2.1 (v4.0) | Low |
| CVE-2026-16194 | zhayujie CowAgent web_fetch.py WebFetch.execute server-side request forgery | CowAgent | 2.1 (v4.0) | Low |
| CVE-2026-16219 | Croogo CMS Admin File Manager FileManager.php isEditable path traversal | CMS | 2.1 (v4.0) | Low |
| CVE-2026-17458 | mf-yang openclaw-cn Browser Control HTTP API agent.act.ts clickViaPlaywright server-side request forgery | openclaw-cn | 2.1 (v4.0) | Low |
| CVE-2026-19828 | 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal | wvp-GB28181-pro | 2.1 (v4.0) | Low |
| CVE-2026-19829 | 648540858 wvp-GB28181-pro Log File Download Endpoint LogController.java path traversal | wvp-GB28181-pro | 2.1 (v4.0) | Low |
| CVE-2026-19927 | OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery | OpenBoxes | 2.1 (v4.0) | Low |
| CVE-2026-5803 | bigsk1 openai-realtime-ui API Proxy Endpoint server.js server-side request forgery | openai-realtime-ui | 2.1 (v4.0) | Low |
| CVE-2026-6111 | FoundationAgents MetaGPT common.py decode_image server-side request forgery | metagpt | 2.1 (v4.0) | Low |
| CVE-2026-6487 | Qihui jtbc5 CMS Code Endpoint manage.php path traversal | jtbc5 CMS | 2.1 (v4.0) | Low |
| CVE-2026-6649 | Qibo CMS headers server-side request forgery | CMS | 2.1 (v4.0) | Low |
| CVE-2026-67224 | RabbitMQ: Admin path-traversal write via trace name | rabbitmq server | 2.1 (v4.0) | Low |
| CVE-2026-7024 | rawchen sims deleteFileServlet Endpoint DeleteFileServlet.java path traversal | sims | 2.1 (v4.0) | Low |
| CVE-2026-74842 | Kira-Pgr PromptShopMCP Image-Toolkit-MCP-Server server.py download_image server-side request forgery | PromptShopMCP | 2.1 (v4.0) | Low |
| CVE-2026-7508 | Bootstrap CMS Page Creation show.blade.php code injection | CMS | 2.1 (v4.0) | Low |
| CVE-2026-7627 | 8nite metatrader-4-mcp sync_ea_from_file index.ts CallToolRequestSchema path traversal | metatrader-4-mcp | 2.1 (v4.0) | Low |
| CVE-2026-76576 | yangzongzhuan RuoYi-Vue Common Download Endpoint CommonController.java resourceDownload path traversal | RuoYi-Vue | 2.1 (v4.0) | Low |
| CVE-2026-7676 | kerwincui FastBee Tool Download Endpoint ToolController.java ToolController.download path traversal | FastBee | 2.1 (v4.0) | Low |
| CVE-2026-7683 | Edimax BR-6428nC Web setWAN command injection | BR-6428nC | 2.1 (v4.0) | Low |
| CVE-2026-8081 | router-for-me CLIProxyAPI api_tools.go server-side request forgery | cliproxyapi | 2.1 (v4.0) | Low |
| CVE-2026-8191 | Wavlink NU516U1 adm.cgi wifi_region os command injection | wl-nu516u1 firmware | 2.1 (v4.0) | Low |
| CVE-2026-82599 | SeaCMS Avatar Upload member.php unlink path traversal | SeaCMS | 2.1 (v4.0) | Low |
| CVE-2026-82603 | SeaCMS Comment Cache member.php del_pl path traversal | SeaCMS | 2.1 (v4.0) | Low |
| CVE-2026-83744 | invoiceninja Invoice Ninja invoices Endpoint Purify.php isHostSafe server-side request forgery | Invoice Ninja | 2.1 (v4.0) | Low |
| CVE-2026-90581 | cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection | nginxWebUI | 2.1 (v4.0) | Low |
| CVE-2026-91853 | TOTOLINK X5000R Export Ovpn cstecgi.cgi exportOvpn os command injection | X5000R | 2.1 (v4.0) | Low |
| CVE-2026-92527 | chatwoot Shopify OAuth callbacks_controller.rb server-side request forgery | chatwoot | 2.1 (v4.0) | Low |
| CVE-2026-94046 | 0215AndrewFeng ACE-MCP MCP Tool getFileSnippet.ts get_file_snippet path traversal | ACE-MCP | 2.1 (v4.0) | Low |
| CVE-2026-94049 | 06ketan slideshot renderer.ts render_slides path traversal | slideshot | 2.1 (v4.0) | Low |
| CVE-2026-96678 | weiqingwen spring-boot-forum Avatar Upload NewUserFormValidator.java validate path traversal | spring-boot-forum | 2.1 (v4.0) | Low |
| CVE-2025-11141 | Ruijie NBR2100G-E branch_passw.php listAction os command injection | NBR2100G-E | 2.0 (v4.0) | Low |
| CVE-2025-12923 | liweiyi ChestnutCMS download resourceDownload path traversal | chestnutcms | 2.0 (v4.0) | Low |
| CVE-2025-14116 | xerrors Yuxi-Know embed.py OtherEmbedding.aencode server-side request forgery | Yuxi-Know | 2.0 (v4.0) | Low |
| CVE-2025-15138 | prasathmani TinyFileManager tinyfilemanager.php path traversal | tiny file manager | 2.0 (v4.0) | Low |
| CVE-2025-15414 | go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery | sonic | 2.0 (v4.0) | Low |
| CVE-2026-112138 | diem-project diem dmCodeEditor actions.class.php join path traversal | diem | 2.0 (v4.0) | Low |
| CVE-2026-114377 | leomoon-studios wiki-go Comment Deletion comments.go DeleteComment path traversal | wiki-go | 2.0 (v4.0) | Low |
| CVE-2026-12211 | Intelbras iNVU 7016 FT Web syslog path traversal | iNVU 7016 FT | 2.0 (v4.0) | Low |
| CVE-2026-16088 | halo-dev halo Files Backup Endpoint MigrationEndpoint.java download path traversal | halo | 2.0 (v4.0) | Low |
| CVE-2026-18856 | Poesis Rhymix CMS Data Import importer.admin.controller.php procImporterAdminCheckXmlFile server-side request forgery | Rhymix CMS | 2.0 (v4.0) | Low |
| CVE-2026-78435 | Faveo Helpdesk Logo SettingsController.php unlink path traversal | Helpdesk | 2.0 (v4.0) | Low |
| CVE-2026-81835 | RooCodeInc Roo-Code MCP Integration Trust Model malicious_mcp_server.py fetch_instructions code injection | Roo-Code | 2.0 (v4.0) | Low |
| CVE-2026-82678 | diem-project diem Administrative Console actions.class.php executeCommand os command injection | diem | 2.0 (v4.0) | Low |
| CVE-2026-86240 | liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery | FeehiCMS | 2.0 (v4.0) | Low |
| CVE-2026-90788 | magicblack MacCMS10 Template .%40template%40default%40html%40label.html os command injection | MacCMS10 | 2.0 (v4.0) | Low |
| CVE-2026-94103 | RooCMS Frontend Rendering site_pagePHP.php eval code injection | RooCMS | 2.0 (v4.0) | Low |
| CVE-2026-113388 | opensource-socialnetwork Cache Settings dynamic.php input code injection | opensource-socialnetwork | 1.9 (v4.0) | Low |
| CVE-2026-40072 | web3.py affected by SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling | web3.py | 1.7 (v4.0) | Low |
| CVE-2025-58161 | MobSF Path Traversal in GET /download/<filename> using absolute filenames | mobile security framework | 1.3 (v4.0) | Low |
| CVE-2026-108827 | Zen Cart Administrative Module Management general.php zen_call_function code injection | Zen Cart | 1.2 (v4.0) | Low |
| CVE-2026-86147 | Apache bRPC: Arbitrary file creation/truncation via /flags and unbounded profiling duration via /pprof | Apache bRPC | N/A | N/A |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.