CWE-35

CWE-35 · 10 records · 2 with a public proof-of-concept

Records the NVD classes under CWE-35, highest CVSS first.

  1. CRITICAL 9.8CVE-2026-828242026-10-01

    Hitachi Coding Software Suite contains a vulnerability related to Path Traversal vulnerability that allows an attacker to access, create, modify, or delete files. This issue affects Hitachi Coding Software Suite: through 3.3.0.

    AI risk analysis on Exploit-DB.ai →

  2. CRITICAL 9.1CVE-2026-444152026-10-13

    Affected systems do not properly restrict access to internal APIs and paths for authenticated users. This could allow an authenticated remote attacker to access sensitive internal information, which in the worst case could be leveraged to facilitate unauthoriz…

    AI risk analysis on Exploit-DB.ai →

  3. HIGH 8.1CVE-2026-1186332026-10-28

    A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM (all versions) after winning a race condition by sustaining repeated attacks for a few minutes when the email proxy is used with scanning en…

    AI risk analysis on Exploit-DB.ai →

  4. HIGH 7.5CVE-2026-397342026-10-30

    Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.

    AI risk analysis on Exploit-DB.ai →

  5. HIGH 7.5CVE-2026-972442026-09-30

    Contributor Path Traversal in Creator LMS <= 1.2.19 versions.

    AI risk analysis on Exploit-DB.ai →

  6. HIGH 7.5CVE-2026-275572026-09-16

    An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing the SSH server's private keys to be read.

    AI risk analysis on Exploit-DB.ai →

  7. MEDIUM 6.8CVE-2026-444142026-10-13

    A vulnerability has been identified in Industrial Edge Cloud Device (IECD), Industrial Edge Device Kit - arm64 V1.10, Industrial Edge Device Kit - arm64 V1.11, Industrial Edge Device Kit - arm64 V1.12, Industrial Edge Device Kit - arm64 V1.13, Industrial Edge …

    AI risk analysis on Exploit-DB.ai →

  8. LOW 3.8CVE-2026-105683public PoC2026-10-05

    Ghost is a Node.js content management system. From 6.14.0 until 6.27.0, an input validation issue may have allowed staff users to access local files outside the intended data storage directories on the server. This issue is fixed in version 6.27.0.

    AI risk analysis on Exploit-DB.ai →

  9. LOW 3.8CVE-2026-103290public PoC2026-10-01

    Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input validation of user-supplied file paths may allow authenticated staff users to access local files outside the intended dat…

    AI risk analysis on Exploit-DB.ai →

  10. UNSCOREDCVE-2026-57032026-10-07

    Path traversal vulnerability in the Satel Iberia SenNet Datalogger Serie 200, specifically in the web portal provided by the device, which allows an authenticated user to read any file or list any directory accessible to the system user running the web server.…

    AI risk analysis on Exploit-DB.ai →