CVE-2026-34015
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit t
CVSS
6.5
Média
EPSS
0.4%
p32
KEV
—
Exploit Today
10
0-100
Publicado: 15 de out. de 2026 · Última mod.: 16 de out. de 2026 · CWE-22
0.4%EPSS · 30 dias0.5%
2026-10-152026-11-06
A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data. We have already fixed the vulnerability in the following version: Video Station 5.8.8 and later
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1222655.9 MÉD—
———The Vanquish Upload Files for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.7.13 via the 'vanupfi_file_name' parameter parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information. The authorization bypass is achieved by supplying a non-existent order ID (e.g., '.pdf'), which causes wc_get_order() to return false and short-circuits the vanupfi_user_can_access_order_files() check, while the is_pdf() branch selector's loose strpos() substring match allows a traversal payload such as '../.pdf/../../../../wp-config.php' to satisfy the PDF branch and be streamed verbatim via readfile().3hCVE-2026-173828.5 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to obtain sensitive information due to a path traversal vulnerability.5hCVE-2026-173808.5 ALT—
———IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access sensitive information belonging to other tenants due to improper validation of a path parameter. A path value in a request is not sufficiently validated, which could allow a user to reach data outside their own tenant.5hCVE-2026-173549.9 CRÍ—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to perform arbitrary file writes due to path traversal.5hCVE-2026-173409.8 CRÍ—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote attacker to execute arbitrary code due to a path traversal vulnerability.5hCVE-2026-173399.1 CRÍ—
———IBM API Connect 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to access or delete resources belonging to other tenants due to path traversal.5h