Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Critical10.0GitLab Community Edition and Enterprise Edition Path Traversal VulnerabilityKEVEPSS 93.0%Sep 11, 2026
- Medium6.8MOOS-IvP through 24.8.1 fails to properly validate variable names extracted from alog files in the SplitHandler, allowing attackers to write files outside the split directory.EPSS 0.2%Sep 3, 2026
- High7.1rConfig Core 8.0.0 before 8.2.13 contains a path traversal vulnerability that allows authenticated users to read arbitrary files by supplying crafted filenames contain…EPSS 0.7%Aug 24, 2026
- High7.2A path traversal vulnerability was found in AWX's project archive extraction.EPSS 1.7%Aug 24, 2026
- High8.2RansomLook contains a path traversal vulnerability in the handling of the screen field associated with group posts.EPSS 0.6%Aug 24, 2026
- High8.8The Mercado Pago Node.js SDK interpolates caller-supplied identifiers into API request paths without percent-encoding them, so characters that are structural in a URL…EPSS 0.5%Aug 24, 2026
- High7.5Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Super Forms allows Path Traversal.EPSS 0.5%Aug 24, 2026
- High8.7NLTK before 3.10.0 contains an arbitrary local file read vulnerability in StreamBackedCorpusView that bypasses pathsec.ENFORCE by calling builtins.open() directly inst…EPSS 0.7%Aug 22, 2026
- High8.7NLTK versions before 3.10.2 contain a symlink-based sandbox bypass in FramenetCorpusReader that allows attackers to read arbitrary XML files outside the corpus root.EPSS 0.7%Aug 22, 2026
- Medium6.8nltk versions before 3.10.2 contain a symlink-based arbitrary file read vulnerability in IPIPANCorpusReader methods that bypass nltk.pathsec validation entirely.EPSS 0.2%Aug 22, 2026
- Low2.0NLTK 3.9.4 through 3.10.2 contains a path traversal vulnerability in CrubadanCorpusReader.EPSS 0.2%Aug 22, 2026
- Medium5.9Infracost provides cloud cost intelligence for engineers, AI coding agents, and CI/CD.EPSS 0.5%Aug 21, 2026
- High8.8Omnigent is an open-source AI agent framework and meta-harness for orchestrating coding agents.EPSS 0.6%Aug 21, 2026
- Medium6.8In ONNX before 1.21.0, the 'save_external_data' function builds the external-data file path from the model's external_data location field and opens it for writing with…Aug 21, 2026
- High8.7is_path_trusted in scripts/iib/api.py compares the requested path against each allowed parent directory with path.startswith(parent_path), without appending a path separator.Aug 21, 2026
- Medium6.9Joomla Extension - yootheme.com - Unauthenticated arbitrary directory listing via the Gallery element in Zoo < 4.1.66.Aug 21, 2026
- High7.0Joomla Extension - yootheme.com - Authenticated, privileged arbitrary file read in YOOtheme Pro 2.3.0-5.0.40 - The Filesystem source's path filter is vulnerable to glo…Aug 21, 2026
- Medium5.3JFrog Artifactory Improper Limitation of a Pathname to a Restricted Directory VulnerabilityKEVEPSS 0.7%Aug 12, 2026
- High8.8GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.8 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have aEPSS 0.8%Aug 12, 2026
- Critical9.8Broadcom VMware vCenter Path Traversal VulnerabilityKEVEPSS 2.6%Jul 30, 2026
- Medium5.0A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiOS 7.6.0 through 7.6.6, FortiOS 7.4.0 through 7.4.9, Fo…EPSS 0.3%Jul 14, 2026
- Low3.1BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extractionEPSS 0.4%Jul 8, 2026
- High7.5A flaw was found in GLib.EPSS 0.8%Jun 30, 2026
- Critical10.0Adobe ColdFusion Path Traversal VulnerabilityKEVEPSS 42.4%Jun 30, 2026
- High7.5Zephyr's HTTP server (subsys/net/lib/http) provides a static-filesystem resource type (HTTP_RESOURCE_TYPE_STATIC_FS, available when CONFIG_FILE_SYSTEM is enabled) that…Jun 29, 2026