CWE-73

449 vulnerabilities with CWE-73

CVE-2026-47358 HIGH

Tenable Terrascan < 1.18.3 - Externally Controlled Reference to a Resource in Another Sphere

CVSS 7.5

CVE-2026-47357 HIGH

Tenable Terrascan < 1.18.3 - Externally Controlled Reference to a Resource in Another Sphere

CVSS 7.5

CVE-2026-29962 HIGH

HSC MailInspector 5.3.3-7 - Path Traversal

CVSS 7.5

CVE-2026-45008 MEDIUM

phpMyFAQ - Path Traversal in Client::deleteClientFolder via URL Parameter

CVSS 6.5

CVE-2026-46383 MEDIUM

Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`

CVSS 5.5

CVE-2026-44641 HIGH

Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install

CVSS 7.1

CVE-2026-42597 MEDIUM

Gotenberg: Chromium URL conversion routes read arbitrary files under /tmp via file:// scheme

CVSS 5.9

CVE-2026-42593 MEDIUM

Gotenberg: Arbitrary PDF read via stampExpression and watermarkExpression in merge, split, and convert routes

CVSS 5.3

CVE-2026-40893 HIGH

Gotenberg: ExifTool Dangerous Tag Blocklist Bypass via Group-Prefixed Tag Names Allows Arbitrary File Rename and Move

CVSS 8.2

CVE-2026-42881 HIGH

STIGQter: Arbitrary File Write leading to Local Code Execution via Export HTML

CVE-2026-3892 HIGH

Motors – Car Dealer, Classifieds & Listing <= 1.4.107 - Authenticated (Subscriber+) Arbitrary File Deletion via 'stm_dealer_logo_path' Parameter

CVSS 8.1

CVE-2026-30905 HIGH

Zoom Communications Zoom Workplace Vdi Plugin < 6.6.11 - External Control of File Name or Path

CVSS 7.8

CVE-2026-0259 MEDIUM

Palo Alto WildFire WF-500/WF-500-B - Arbitrary File Read/Delete

CVE-2026-43891 HIGH

changedetection.io: Arbitrary Local File Read via crafted backup restore

CVSS 7.5

CVE-2026-41107 HIGH

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

CVSS 7.4

CVE-2026-41088 HIGH

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

CVSS 7.8

CVE-2026-40421 MEDIUM

Microsoft Word Information Disclosure Vulnerability

CVSS 4.3

CVE-2026-40370 HIGH

Microsoft SQL Server - File Path Control Remote Code Execution

CVSS 8.8

CVE-2026-32204 HIGH

Azure Monitor Agent Elevation of Privilege Vulnerability

CVSS 7.8

CVE-2026-43989 HIGH

JunoClaw: upload_wasm accepted arbitrary filesystem paths without validation

CVSS 8.5

CVE-2026-8043 CRITICAL

Ivanti Xtraction < 2026.2 - Authenticated Path Traversal and Arbitrary File Write

CVSS 9.6

CVE-2026-42866 MEDIUM

Tookie: Arbitrary file write via path traversal in -u username / -U userfile output filename

CVE-2026-42845 HIGH

Grav: Anonymous Page Content Overwrite via Form File Upload filename Override

CVE-2026-41693 HIGH

i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite

CVSS 8.2

CVE-2026-44127 HIGH

SEPPmail Secure Email Gateway - Local File Inclusion (LFI) and Arbitrary File Deletion