Tag
#Path Traversal
Understanding and Defending Against CVE-2026-65687: A Critical Path Traversal Vulnerability in Bold Reports Standalone Report Designer
CVE-2026-65687 is a critical vulnerability in Bold Reports Standalone Report Designer before version 14.1.12. This vulnerability allows unauthenticated attackers to read arbitrary files from the server filesystem by exploiting a missing filepath validation in the SVG processing feature. With a CVSS score of 9.8, this vulnerability poses a significant risk as it can lead to full unauthorized access to the application. Understanding the mechanics of this vulnerability and implementing defensive measures is crucial for protecting against potential attacks.
Critical Path Traversal Vulnerability in Red Hat Ansible Automation Platform and Satellite (CVE-2026-12701)
A high-severity path traversal vulnerability (CVE-2026-12701, CVSS 9) was discovered in pulpcore, affecting Red Hat Ansible Automation Platform and Satellite. An authenticated administrator can exploit this flaw to write arbitrary files to any location writable by the Pulp service user, potentially leading to service compromise or further system exploitation. Immediate patching is recommended.
CVE-2026-12898: Unauthenticated Log File Creation/Append Vulnerability in All-in-One WP Migration and Backup Plugin
A vulnerability in the All-in-One WP Migration and Backup WordPress plugin before version 7.106 allows unauthenticated attackers to create or append log files in arbitrary locations. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity. Affected versions are prior to 7.106.
Critical Path Traversal Vulnerability in JetBrains IntelliJ IDEA
A critical vulnerability (CVE-2026-59792) with a CVSS score of 9.6 was discovered in JetBrains IntelliJ IDEA, allowing for code execution via path traversal in project workspace ID handling. Users of IntelliJ IDEA versions before 2026.1.4 and 2026.2 are affected. Immediate action is required to update to a patched version.
Understanding and Defending Against CVE-2026-58302: A LinuxCNC Privilege Escalation Vulnerability
CVE-2026-58302 is a privilege escalation vulnerability in LinuxCNC before version 2.9.9, allowing unprivileged local users to escalate privileges to root. This vulnerability is caused by insufficient validation of user-supplied module names, leading to path traversal and arbitrary shared library loading. The vulnerability has a CVSS score of 8.4, indicating high severity.
CVE-2026-40521: Path Traversal Vulnerability in FrontAccounting
A path traversal vulnerability in FrontAccounting before 2.4.20 allows authenticated attackers to execute arbitrary code by uploading files with traversal sequences. This vulnerability has a CVSS score of 8.8 and is considered high severity.
Critical Vulnerability in Jenkins External Workspace Manager Plugin Allows Remote Code Execution
A critical vulnerability, CVE-2026-57296, with a CVSS score of 8.8, was discovered in the Jenkins External Workspace Manager Plugin. This vulnerability allows attackers with Item/Configure permission to read arbitrary files on the Jenkins controller file system, potentially leading to remote code execution. The plugin versions 1.3.2 and earlier are affected. Organizations using this plugin are urged to update to the latest version to mitigate this vulnerability.
CVE-2026-42129: Grafana Loki Datasource Plugin Path Traversal Vulnerability
A path traversal vulnerability in the Grafana Loki datasource plugin allows an authenticated Viewer-role user to access administrative Loki endpoints and extract sensitive backend configuration and internal service information. This vulnerability has a CVSS score of 7.7 and is considered HIGH severity. Affected users should update Grafana OSS to a patched version.