CWE-35 · weakness in File and Path Handling
Path Traversal: '.../...//'
201 CVEs · 1 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 1
- check available
- 5
- likely to be exploited
- 3
Every one of the 201 is a mark on the map. Named now: 1 to 26, most at risk first.
- Path traversal vulnerability in WinRAR
- LG LED Assistant - Thumbnail Path Traversal File Upload
- Splunk Enterprise - Local File Inclusion
- Cisco SD-WAN vManage Software - Local File Inclusion
- WhoDB < 0.45.0 - Path Traversal
- TRUfusion Enterprise <= 7.10.4.0 - Path Traversal
- Cisco Security Manager Path Traversal Vulnerability
- Path Traversal in Splunk App for Lookup File Editing
- File Parsing Deserialization of Untrusted Data in DTM Soft
- The html-pages node module contains a path traversal vulnerabilities that allows an attacker to read any file from the server with cURL.
- jsPDF has Local File Inclusion/Path Traversal vulnerability
- Delta Electronics InfraSuite Device Master Path Traversal
- Cisco Network Services Orchestrator Path Traversal Vulnerability
- Improper Input Validation leading to Path Traversal in CycloneDX BOM Repository Server
- Cisco Unified Communications Products Vulnerabilities
- Cisco Unified Communications Products Vulnerabilities
- Cisco Unified Communications Products Vulnerabilities
- Cisco Unified Communications Products Vulnerabilities
- Sauter: Directory Traversal in importFile SOAP Method
- Directory Travel in PHPVibe v11.0.46 due to incomplete blacklist checksums and directory checks, which can lead to code execution via writing specific statements to .htaccess and…
- Rocket TRUfusion Enterprise through 7.10.5 exposes the endpoint at /axis2/services/WsPortalV6UpDwAxis2Impl to authenticated users to be able to upload files. However, the applicat…
- Franklin Electric Fueling Systems Colibri Path Traversal
- NVIDIA Mellanox OS, ONYX, Skyway, and MetroX-3 XCC contain a vulnerability in the web support, where an attacker can cause a CGI path traversal by a specially crafted URI. A succe…
- A CWE-35 "Path Traversal" in the template deletion mechanism in Q-Free MaxTime less than or equal to version 2.11.0 allows an authenticated remote attacker to delete sensitive fil…
- Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability
- Microsoft Purview eDiscovery Remote Code Execution Vulnerability
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.