CWE-24
- 3
- vulnerabilities tracked
- 20 August 2026
- latest publication
cve
Vulnerability watch
idvulnerabilityseveritypublished
CVE-2026-14947A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of archive entry paths before writing files to disk which could result in full system compromise.NVD analysis in progress High CVSS 7.2 CVE-2026-66140Exim before 4.99.5 allows directory traversal to access files outside of the spool area, and consequently gain privileges, because arguments related to queue-name are mishandled.Exim High CVSS 8.4 CVE-2026-46687Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified. High CVSS 7.7