CVE-2026-107331 is an absolute path traversal vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. It allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths. The vulnerability has a critical severity with a CVSS score of 9.9, indicating high impact on confidentiality, integrity, and availability.
Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status directory. Where write access has been enabled, to create or overwrite JSON files outside that directory. This issue is reachable through directory traversal sequences or an absolute path supplied in the project name input.
To remediate this issue, users should upgrade to version v0.2.1.
CVE-2026-83746 is an absolute path traversal vulnerability in Microsoft Skype for Business Server 2015 CU13. It allows an authorized attacker to elevate privileges over a network. The vulnerability affects specific versions prior to fixed releases. A high-severity CVSS score of 8.1 has been assigned. An official fix is available from Microsoft.
CVE-2026-70297 is an absolute path traversal vulnerability in Microsoft Skype for Business Server 2015 CU13. It allows an authorized attacker to execute code remotely over a network. The vulnerability affects specific versions prior to fixed releases. A high-severity CVSS 3.1 score of 8.8 reflects the critical impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for the affected versions.
CVE-2026-83683 is an absolute path traversal vulnerability in the Windows Encrypting File System (EFS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to disclose information over a network. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. Microsoft has released official fixes for all affected versions.
CVE-2026-83784 is an absolute path traversal vulnerability in the Windows Encrypting File System (EFS) affecting multiple versions of Microsoft Windows 10, including Version 1607. This flaw allows an authorized attacker to elevate privileges over a network. The vulnerability has been assigned a high severity with a CVSS score of 8.8. Official fixes have been released for all affected versions.
CVE-2026-55062 is a path traversal vulnerability in the uniget-org CLI tool prior to version 0.27.6. The vulnerability arises from the hooks edit command concatenating an unvalidated hook filename with the hooks directory path, allowing directory traversal outside the intended directory. This can lead to unauthorized file access or modification with the privileges of the uniget process. The issue is fixed in version 0.27.6.
CVE-2026-82092 is an absolute path traversal vulnerability in IBM DataStage on Cloud Pak for Data version 5.4.0.0. This flaw allows a remote authenticated attacker to access sensitive information by exploiting improper validation of file paths. The vulnerability has a high severity rating with a CVSS score of 8.8, indicating significant impact on confidentiality, integrity, and availability.
CVE-2026-68487 is a critical absolute path traversal vulnerability in WebPros Plesk's Backup Manager. It allows an authenticated customer to write arbitrary files as root on the affected system. The flaw affects Plesk versions up to and including 18.0.80.6 and 18.0.79.10. This vulnerability has a very high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability.
GeoVision GV-LPC2211 V1.13 fails to restrict the filename supplied to BKDownloadLink.cgi, allowing a remote user with valid web credentials to read arbitrary files accessible to the root-run web service.
CVE-2026-68896 is an absolute path traversal vulnerability in the Microsoft Windows Search Component affecting Windows 11 version 23H2. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has a high severity rating with a CVSS score of 7.8. Microsoft has released official fixes for affected versions.
CVE-2026-69612 is a high-severity vulnerability in Microsoft Windows 10 Version 1607 and other specified versions involving an absolute path traversal flaw in Windows Error Reporting. This flaw allows an authorized local attacker to elevate privileges. The vulnerability has been officially fixed in multiple Windows versions as listed by Microsoft.
CVE-2026-47630 is an absolute path traversal vulnerability in NVIDIA Triton Inference Server for Linux. An attacker with limited privileges could exploit this flaw to cause absolute path traversal, potentially leading to code execution. The vulnerability has a medium severity rating with a CVSS score of 5.5. There is no indication of known exploits in the wild or an official patch available at this time.
NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exploit might lead to code execution and information disclosure.
compliance-trestle is a tooling platform for managing compliance as code. Prior to versions 3.12.2 and 4.0.3, the `-o/--output` argument in `trestle author jinja` allows writing files outside the intended workspace. The application does not properly validate, `../`, `..\`, or absolute paths. This allows arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.
Tobit Laboratories AG TeamDavid's Webbox is vulnerable to a path traversal vulnerability in the
archive creation functionality. Because the archive path is
user-controlled and insufficiently validated, an attacker can manipulate
the input to traverse directories. This allows the creation of folders
in arbitrary locations, including sensitive directories such as
C:\Windows or for different users. This issue affects TeamDavid before Rollout 528.
Starting with Rollout 528 (June 30, 2026), the affected functionality is disabled by default and the vulnerabilities are therefore no longer exposed through this functionality.
Eclipse Theia versions up to and including 1.73.1 contain a directory traversal vulnerability in the @theia/filesystem backend HTTP file-download endpoints. These endpoints convert client-supplied URIs directly to filesystem paths without restricting access to the workspace or allowed roots. In browser deployments, token enforcement is ineffective on HTTP requests, allowing unauthenticated clients to read any file accessible by the backend process, including sensitive files outside the workspace. Electron mode is not affected by this vulnerability via this path.