CWE-22 · weakness in File and Path Handling
Path Traversal
10,483 CVEs · 85 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 85
- check available
- 549
- likely to be exploited
- 524
Every one of the 10,483 is a mark on the map. Named now: 1 to 26, most at risk first.
- Openfire Administration Console - Authentication Bypass
- WSO2 Management - Arbitrary File Upload & Remote Code Execution
- Atlassian Jira Limited - Local File Inclusion
- VMware vCenter Server - Arbitrary File Upload
- F5 BIG-IP TMUI - Remote Code Execution
- Citrix ADC and Gateway - Directory Traversal
- Pulse Connect Secure SSL VPN Arbitrary File Read
- Fortinet FortiOS - Credentials Disclosure
- Apache 2.4.49 - Path Traversal and Remote Code Execution
- Buffalo WSR-2533DHPL2 - Path Traversal
- Apache 2.4.49/2.4.50 - Path Traversal and Remote Code Execution
- Apache OFBiz Directory Traversal - Remote Code Execution
- Atlassian Confluence Server - Path Traversal
- Microsoft Exchange Server Remote Code Execution Vulnerability
- VMware vSphere Client (HTML5) - Remote Code Execution
- Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI
- SolarWinds Serv-U - Directory Traversal
- Progress Software WhatsUp Gold GetFileWithoutZip Directory Traversal - Remote Code Execution
- nostromo 1.9.6 - Remote Code Execution
- SysAid Server - Remote Code Execution
- Zimbra Collaboration Suite 8.8.15/9.0 - Zip Path Traversal
- Ivanti Cloud Services Appliance - Path Traversal
- Rails File Content Disclosure
- Microsoft MSHTML Remote Code Execution Vulnerability
- WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion
- Commvault - SSRF via /commandcenter/deployWebpackage.do
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.