medium6.1
CVE-2026-61725
sevenz-rust2: unchecked 7z entry paths permit traversal and absolute-path file overwrites
hasenbanck · sevenz-rust2
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
201 matching advisories · 30 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
high7.0
medium5.3
CVE-2026-119342
Stirling-PDF: SVG→PDF local file read (LFI) via SVG-sanitizer and Batik same-origin bypass
Stirling-Tools · Stirling-PDF
high8.4
CVE-2026-116249
pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory
pgadmin.org · pgAdmin 4
high7.1
CVE-2026-116240
pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked
pgadmin.org · pgAdmin 4
medium6.5
CVE-2026-119328
Immich: Unauthenticated filesystem path injection (arbitrary directory write + recursive delete) in the machine-learning service
immich-app · immich
high8.2
CVE-2026-62331
praktor: Telegram upload traversal permits persistent agent instruction injection
mtzanidakis · praktor
medium5.0
CVE-2026-115604
WordPress SureDash plugin <= 1.12.3 - Arbitrary File Deletion vulnerability
Brainstorm Force · SureDash
high8.8
CVE-2026-119979
LM Studio before 0.4.22+1 Path Traversal via Model Downloader
Element Labs · LM Studio
high7.0
CVE-2026-84243
gettext: Directory traversal via the LANGUAGE environment variable
The GNU C Library · glibc
medium4.9
CVE-2026-104739
JS Help Desk <= 5.0.1 - Authenticated (Administrator+) Path Traversal to Arbitrary File Deletion via 'support_custom_img' Parameter
rabilal · JS Help Desk – AI-Powered Support & Ticketing System
critical10.0
CVE-2026-61738
SOCFortress CoPilot: Arbitrary Host File Write as Root via Path Traversal in the ScoutSuite GCP Report Upload (RCE)
socfortress · CoPilot
unknown
high8.2
medium6.8
CVE-2026-119546
Forgejo through 15.0.11, 16.0.7, and 17.0.1 Path Traversal via restore-repo
forgejo · forgejo
high8.3
CVE-2026-61576
Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
lightdash · lightdash
high7.5
CVE-2026-118758
Kubeflow: Unauthenticated path traversal to arbitrary file read on ml-pipeline-ui via the volume artifact source
kubeflow · pipelines
critical9.9
CVE-2026-119145
Frappe before 15.121.0 and 16.x before 16.34.0 Path Traversal RCE via File Upload
frappe · frappe / frappe · frappe
medium5.3
CVE-2026-90871
Path Traversal Leading to File Deletion in Ad Hoc Transfer and Web Transfer in Progress WS_FTP Server
Progress Software · WS_FTP Server
critical9.1
CVE-2026-90866
Virtual Folder Path Confinement Bypass in Progress WS_FTP Server
Progress Software · WS_FTP Server
critical9.1
CVE-2026-90864
Host Administrator Path Containment Bypass in Progress WS_FTP Server
Progress Software · WS_FTP Server
high7.7
CVE-2026-84294
Information Disclosure in Ad Hoc Transfer in Progress WS_FTP Server
Progress Software · WS_FTP Server
medium6.5
medium6.5
low3.5
medium6.3
CVE-2026-113576
Adobe Digital Editions | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
Adobe · Adobe Digital Editions
medium6.5
high8.8
low2.3
medium5.3
CVE-2026-80069
MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax
Stylemix · MasterStudy LMS WordPress Plugin