Monthly
Unauthenticated path traversal in the report blob endpoint of JetBrains Datalore before version 2026.2.1 allows a remote attacker who can reach the service to read arbitrary files accessible to the Datalore process. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH), exploitation requires no credentials and no user interaction, making exposure the primary limiting factor: only network-reachable instances below 2026.2.1 are at risk, and the flaw yields confidentiality loss only, with no integrity or availability impact and no code execution on its own. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low-complexity, unauthenticated nature of the bug makes it an attractive target for opportunistic scanning of internet-facing deployments.
Authenticated administrators on a connected P4 Server can exploit a relative path traversal (CWE-23) in P4 Search 2026.4.2 and earlier by supplying a crafted logging configuration, causing files to be written or deleted outside the intended logging directory and potentially achieving code execution as the P4 Search service account. Perforce resolved the issue in P4 Search 2026.4.3; no public exploit code has been identified at time of analysis (no CISA KEV listing), and because a P4 Server administrative account is a hard prerequisite, this is a genuine but conditional integrity/availability risk rather than a mass-exploitation priority.
Authenticated path traversal in QNAP QuMagie lets an attacker who already holds a QuMagie administrator account read files and system data outside the intended media library on the underlying QNAP NAS. The flaw is remote, network-reachable and low-complexity, but the PR:H privilege requirement in the CVSS vector means it is not exploitable by anonymous users against default installations; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped a fix in QuMagie 2.9.1 and later, so exposure is limited to NAS deployments still running older QuMagie builds and reachable by an admin-level account.
Authenticated path traversal in QNAP Download Station allows a remote user with a valid account to read arbitrary files outside the intended directory, potentially exposing system data. Affected versions are Download Station 5.10.x before 5.10.2.313 and 5.11.x before 5.11.3.322; the vendor has released fixes. No public exploit code or active exploitation has been identified at time of analysis, and the risk is conditional on valid credentials and network reachability to the NAS.
Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 expose a path traversal flaw in the GET /api/v1/pack endpoint that lets unauthenticated remote attackers read arbitrary files outside the configured --root directory, with the stolen content returned as a downloadable tar.gz archive. The root cause is a handler that calls the unguarded root() helper at server/rest/index.js:130 instead of the root.resolve() validation wrapper used on other endpoints, so percent-encoded traversal sequences in the pack path escape the intended document root and reach files such as /etc/passwd or SSH private keys. Impact is confidentiality-only (no write or code-execution primitive), and no public exploit identified at time of analysis, though a vendor patch (v19.21.2) and a public technical write-up are available; exploitation requires network reachability to the cloudcmd HTTP service, which many deployments gate behind localhost binding, a reverse proxy, or optional authentication.
Relative path traversal in OpenSSH for Windows (CWE-23) can allow an unauthenticated remote attacker to escape intended directories during an SSH interaction and, ultimately, execute code on the affected host - carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and rated by SSVC as having total technical impact. Exploitation is not attacker-autonomous: it requires the victim to use the OpenSSH for Windows component and to initiate or accept an SSH connection to an attacker-controlled or compromised endpoint (the UI:R user-interaction requirement), and the host must be running a build below its fixed release (for example Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2022 below 10.0.20348.5761). Current intelligence shows no public exploit identified at time of analysis, SSVC exploitation status of 'none', and non-automatable delivery, so this is a high-priority-on-paper issue whose real-world urgency is tempered by the lack of confirmed exploitation - vendor patches are available per the Microsoft advisory and should still be prioritized.
Local privilege escalation in Windows Shell allows an authenticated attacker who already holds low-privileged code execution on a Windows host to elevate to SYSTEM-level rights by supplying a crafted relative path to a privileged shell operation, causing path-traversal sequences to escape the intended directory (CWE-23, CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are default installations of the Windows client and server builds enumerated in the vendor and EUVD data, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core variants. There is no public exploit identified at time of analysis and CISA's SSVC decision framework records exploitation as none with automatable set to no, so this is a patch-priority item rather than an emergency; vendor patches are available and no user interaction is required once the attacker has local access.
Local privilege escalation in Windows Shell allows an attacker who already holds a low-privileged, authenticated account on a Windows host to traverse relative paths and raise their privileges to a higher integrity level (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote or initial-access vector - it requires existing local code execution or account access, but needs no user interaction and is low-complexity once that foothold exists. CISA's SSVC assessment records no observed exploitation and no automatable path, and no public exploit has been identified at time of analysis; vendor patches are available, making this a credible but second-tier prioritization compared with actively exploited or remotely reachable issues.
Relative path traversal in Satel Netco Design versions prior to v2.1.7 lets an authenticated user holding only Viewer privileges write attacker-influenced files to any filesystem location reachable by the application service account, which can escalate to arbitrary code execution where a writable location is later executed or loaded by the service. The flaw affects the product's data export functionality (CWE-23) and is remotely reachable over the network, but requires a valid low-privileged account (CVSS 3.1 vector PR:L), so anonymous access is not sufficient. Rated 8.7 under CVSS 4.0 and reported through CISA ICS-CERT advisory ICSA-26-281-03; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. The full RCE outcome is conditional on deployment-specific file-write-then-execute paths; absent those, impact is confined to unauthorized file creation or modification within application-accessible directories.
Unauthenticated path traversal in the report blob endpoint of JetBrains Datalore before version 2026.2.1 allows a remote attacker who can reach the service to read arbitrary files accessible to the Datalore process. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH), exploitation requires no credentials and no user interaction, making exposure the primary limiting factor: only network-reachable instances below 2026.2.1 are at risk, and the flaw yields confidentiality loss only, with no integrity or availability impact and no code execution on its own. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low-complexity, unauthenticated nature of the bug makes it an attractive target for opportunistic scanning of internet-facing deployments.
Authenticated administrators on a connected P4 Server can exploit a relative path traversal (CWE-23) in P4 Search 2026.4.2 and earlier by supplying a crafted logging configuration, causing files to be written or deleted outside the intended logging directory and potentially achieving code execution as the P4 Search service account. Perforce resolved the issue in P4 Search 2026.4.3; no public exploit code has been identified at time of analysis (no CISA KEV listing), and because a P4 Server administrative account is a hard prerequisite, this is a genuine but conditional integrity/availability risk rather than a mass-exploitation priority.
Authenticated path traversal in QNAP QuMagie lets an attacker who already holds a QuMagie administrator account read files and system data outside the intended media library on the underlying QNAP NAS. The flaw is remote, network-reachable and low-complexity, but the PR:H privilege requirement in the CVSS vector means it is not exploitable by anonymous users against default installations; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. QNAP has shipped a fix in QuMagie 2.9.1 and later, so exposure is limited to NAS deployments still running older QuMagie builds and reachable by an admin-level account.
Authenticated path traversal in QNAP Download Station allows a remote user with a valid account to read arbitrary files outside the intended directory, potentially exposing system data. Affected versions are Download Station 5.10.x before 5.10.2.313 and 5.11.x before 5.11.3.322; the vendor has released fixes. No public exploit code or active exploitation has been identified at time of analysis, and the risk is conditional on valid credentials and network reachability to the NAS.
Unauthenticated remote code execution in Cisco Secure Email Gateway allows attackers to write arbitrary files and execute commands as root by sending a crafted email attachment when the AMP file reputation service is enabled. The flaw, a relative path traversal (CWE-23) in attachment handling, requires no authentication or user interaction, but only gateways with file reputation active are vulnerable. No public exploit or active exploitation has been identified at time of analysis, though the critical CVSS score of 9.8 and the configuration prerequisite make it a priority for defenders to inventory exposed appliances.
Cloud Commander (cloudcmd) versions 19.20.2 through 19.21.1 expose a path traversal flaw in the GET /api/v1/pack endpoint that lets unauthenticated remote attackers read arbitrary files outside the configured --root directory, with the stolen content returned as a downloadable tar.gz archive. The root cause is a handler that calls the unguarded root() helper at server/rest/index.js:130 instead of the root.resolve() validation wrapper used on other endpoints, so percent-encoded traversal sequences in the pack path escape the intended document root and reach files such as /etc/passwd or SSH private keys. Impact is confidentiality-only (no write or code-execution primitive), and no public exploit identified at time of analysis, though a vendor patch (v19.21.2) and a public technical write-up are available; exploitation requires network reachability to the cloudcmd HTTP service, which many deployments gate behind localhost binding, a reverse proxy, or optional authentication.
Relative path traversal in OpenSSH for Windows (CWE-23) can allow an unauthenticated remote attacker to escape intended directories during an SSH interaction and, ultimately, execute code on the affected host - carrying a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and rated by SSVC as having total technical impact. Exploitation is not attacker-autonomous: it requires the victim to use the OpenSSH for Windows component and to initiate or accept an SSH connection to an attacker-controlled or compromised endpoint (the UI:R user-interaction requirement), and the host must be running a build below its fixed release (for example Windows 11 24H2 below 10.0.26100.9711 or Windows Server 2022 below 10.0.20348.5761). Current intelligence shows no public exploit identified at time of analysis, SSVC exploitation status of 'none', and non-automatable delivery, so this is a high-priority-on-paper issue whose real-world urgency is tempered by the lack of confirmed exploitation - vendor patches are available per the Microsoft advisory and should still be prioritized.
Local privilege escalation in Windows Shell allows an authenticated attacker who already holds low-privileged code execution on a Windows host to elevate to SYSTEM-level rights by supplying a crafted relative path to a privileged shell operation, causing path-traversal sequences to escape the intended directory (CWE-23, CVSS 3.1 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Affected are default installations of the Windows client and server builds enumerated in the vendor and EUVD data, spanning Windows 10 1607 through 22H2, Windows 11 23H2 through 26H2, and Windows Server 2012 through 2025, including Server Core variants. There is no public exploit identified at time of analysis and CISA's SSVC decision framework records exploitation as none with automatable set to no, so this is a patch-priority item rather than an emergency; vendor patches are available and no user interaction is required once the attacker has local access.
Local privilege escalation in Windows Shell allows an attacker who already holds a low-privileged, authenticated account on a Windows host to traverse relative paths and raise their privileges to a higher integrity level (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not a remote or initial-access vector - it requires existing local code execution or account access, but needs no user interaction and is low-complexity once that foothold exists. CISA's SSVC assessment records no observed exploitation and no automatable path, and no public exploit has been identified at time of analysis; vendor patches are available, making this a credible but second-tier prioritization compared with actively exploited or remotely reachable issues.
Relative path traversal in Satel Netco Design versions prior to v2.1.7 lets an authenticated user holding only Viewer privileges write attacker-influenced files to any filesystem location reachable by the application service account, which can escalate to arbitrary code execution where a writable location is later executed or loaded by the service. The flaw affects the product's data export functionality (CWE-23) and is remotely reachable over the network, but requires a valid low-privileged account (CVSS 3.1 vector PR:L), so anonymous access is not sufficient. Rated 8.7 under CVSS 4.0 and reported through CISA ICS-CERT advisory ICSA-26-281-03; no public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited. The full RCE outcome is conditional on deployment-specific file-write-then-execute paths; absent those, impact is confined to unauthorized file creation or modification within application-accessible directories.