CVE-2026-113818
Relative path traversal in Windows Deployment Services allows an authorized attacker to disclose information over a network.
CVSS
6.5
Média
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-23
Ainda não há histórico EPSS suficiente.
Relative path traversal in Windows Deployment Services allows an authorized attacker to disclose information over a network.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1182135.9 MÉD—
——0Relative path traversal in Windows Deployment Services allows an unauthorized attacker to disclose information over a network.2hCVE-2026-1127628.8 ALT—
——0Relative path traversal in Windows Print Spooler Components allows an unauthorized attacker to elevate privileges over a network.3hCVE-2026-1055057.8 ALT—
——0Relative path traversal in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.3hCVE-2026-1240346.4 MÉD41.6%
——12Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a remote authenticated user with S3 write access to a hybrid job's input data location to overwrite arbitrary files with the privileges of the user running the job via crafted S3 object keys.
We recommend you upgrade to amazon-braket-sdk version 1.127.7 or later.23hCVE-2026-1240336.4 MÉD38.1%
——11The export-cluster-logs and export-image-logs commands in the AWS ParallelCluster CLI before version 3.16.0 contain a relative path traversal issue. An authenticated remote user with write access to the log export Amazon S3 bucket could use a crafted S3 object key to write files outside the intended export directory on the machine running the command. The written files would have names and content controlled by a third party, and would be created with the privileges of the user running the command.
To remediate this issue, users should upgrade to version 3.16.0 or later.1dCVE-2026-104620—6.8%
——2A path traversal attack in simulation of actions in the Zypp backend of PackageKit before 1.4.1 could be used by local attackers to gain root privileges.17h