CVE-2024-38258
Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
CVSS
6.5
Média
EPSS
4.7%
p92
KEV
—
Exploit Today
28
0-100
Publicado: 10 de set. de 2024 · Última mod.: 10 de ago. de 2026 · CWE-23
4.7%EPSS · 30 dias4.7%
2026-10-172026-11-13
Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-124726——
——0Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX.
A caller of the MCP endpoint can invoke endpoints the OpenAPI document
never declared, under the declared tool's HTTP method, using the credentials the
Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0.
Users are recommended to upgrade to version 3.20.0, which fixes the issue.1dCVE-2026-107398——
——0Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.1dCVE-2026-95379——
——0Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.1dCVE-2026-1189767.5 ALT—
——0In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.2dCVE-2026-1114357.4 ALT37.4%
——11Relative path traversal vulnerability in openEuler iSulad on Linux.
This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.
This issue affects iSulad: through 2.1.6.
In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.2dCVE-2026-120495—40.4%
——12Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.1d