CWE-35 vulnerabilities

Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

CVE-2026-118633 is a path traversal vulnerability in Sophos SG UTM that allows a remote unauthenticated attacker to execute arbitrary code as root by exploiting a race condition when the email proxy with scanning enabled is used. This affects all versions up to 9.724. Sophos UTM is end-of-life, and the patch must be applied manually.

CVE-2026-44415 is a critical path traversal vulnerability in Siemens Industrial Edge Device Kit - arm64 V1.10. Authenticated users can exploit improper restrictions on internal APIs and paths to access sensitive internal information. This can lead to unauthorized system access or data deletion.

CVE-2026-44414 is a path traversal vulnerability in Siemens Industrial Edge Cloud Device (IECD) and related Industrial Edge Device Kit versions. Authenticated remote attackers can exploit improper access restrictions to internal APIs and paths, potentially accessing sensitive internal information. The vulnerability affects multiple versions of the Industrial Edge Device Kit for both arm64 and x86-64 architectures, as well as various Siemens Industrial Edge devices. The CVSS 3.1 score is 6.8 (medium severity), indicating a significant confidentiality impact but no integrity or availability impact. No official patch or remediation details are provided in the available data.

Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server. This is possible by modifying the URL to include a path traversal payload. Successful exploitation of this vulnerability could allow an attacker to access critical system files containing confidential information.

Ghost, a Node.js content management system, had a path traversal vulnerability in versions 6.14.0 through 6.26.0. This vulnerability allowed staff users to access local files outside the intended data storage directories due to an input validation issue. The issue was fixed in version 6.27.0. The vulnerability has a low severity score and requires staff-level privileges to exploit.

Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0.

Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.

import_contacts Path Traversal in Groundhogg <= 4.7.1 versions.

CVE-2026-21103 is a path traversal vulnerability in Samsung Mobile Devices' GalaxyDiagnostics component prior to the SMR Sep-2026 Release 1. This flaw allows physical attackers to access files with system-level privileges. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.8. No specific affected versions or patch information is provided.

CVE-2026-21092 is a path traversal vulnerability in the ImsService component of Samsung Mobile Devices prior to the SMR Sep-2026 Release 1. This flaw allows remote attackers to create image files with system server privileges, potentially leading to unauthorized file creation at elevated privilege levels. The vulnerability has a high severity rating with a CVSS 4.0 score of 8.8.

In Audio HAL, there is a possible information disclosure due to improper input validation. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11087533; Issue ID: MSV-8245.

Dell ObjectScale versions prior to 4.3.0.1 contain a path traversal vulnerability (CWE-35) that could allow a low privileged local attacker to disclose information. This vulnerability does not impact integrity or availability and has a low CVSS score of 3.3. A fix is available in version 4.3.0.1 and later.

Dell ObjectScale versions prior to 4.3.0.1 contain a path traversal vulnerability (CWE-35) that allows a low privileged local attacker to tamper with information. This vulnerability can be exploited without user interaction and has a high severity rating.

Subscriber Path Traversal in Do Lasso <= 358 versions.

A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). The affected application is vulnerable to a path traversal vulnerability due to lack of sanitization of user input. This could allow a remote attacker to access arbitrary files on the application.

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network.