CWE-36 · weakness in File and Path Handling
Absolute Path Traversal
146 CVEs · 5 exploited
Every dot is a CVE; the named ones are the most at risk. Red is exploited in the wild.
- exploited in the wild
- 5
- check available
- 4
- likely to be exploited
- 3
Every one of the 146 is a mark on the map. Named now: 1 to 26, most at risk first.
- Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcardRecursive
- In WinRAR versions prior to and including 5.61, There is path traversal vulnerability when crafting the filename field of the ACE format (in UNACEV2.dll). When the filename field…
- NAKIVO Backup and Replication Solution - Unauthenticated Arbitrary File Read
- Ivanti EPM - Credential Coercion Vulnerability in GetHashForWildcard
- Ivanti EPM - Credential Coercion Vulnerability in GetHashForSingleFile
- MLflow Absolute Path Traversal
- Java-springboot-codebase 1.1 - Arbitrary File Read
- Gradio - Absolute Path Traversal
- LOLLMS WebUI - Absolute Path Traversal
- Path Traversal Vulnerability
- Path traversal issue in Deep Java Library
- Barracuda RMM < 2025.1.1 Service Center Absolute Path Traversal RCE
- Wyse Management Suite versions 3.2 and earlier contain an absolute path traversal vulnerability. A remote authenticated malicious user could exploit this vulnerability in order to…
- Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write Vulnerabilities
- Cisco Small Business RV160, RV160W, RV260, RV260P, and RV260W VPN Routers Arbitrary File Write Vulnerabilities
- Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensi…
- Microsoft Defender for IoT Remote Code Execution Vulnerability
- Microsoft Defender for IoT Remote Code Execution Vulnerability
- Cisco Intersight Virtual Appliance Vulnerabilities
- Skype for Business Remote Code Execution Vulnerability
- A vulnerability in the content scanning and message filtering features of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to overwrite arbitrary files o…
- Weaver OA downfile.php absolute path traversal
- In Netgate pfSense CE 2.8.0, the "WebCfg - Diagnostics: Command" privilege allows reading arbitrary files via diag_command.php dlPath directory traversal. NOTE: the Supplier's per…
- Butterfly has path/URL confusion in resource handling leading to multiple weaknesses
- Path Traversal vulnerability in SonicWall GMS and Analytics allows a remote authenticated attacker to read arbitrary files from the underlying file system via web service. This is…
- An Absolute Path Traversal issue was discovered in Advantech WebAccess Version 8.1 and prior. The absolute path traversal vulnerability has been identified, which may allow an att…
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.