CVEs classified under CWE-73, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (50)
CVE-2026-20358 — CVSS 10.0 (critical): As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Crosswork engineering team has conducted a…
CVE-2026-50148 — CVSS 10.0 (critical): Metabase is an open-source business intelligence and embedded analytics tool. From 1.54.0 until 1.54.24, 1.55.24, 1.56.25, 1.57.19…
CVE-2025-71338 — CVSS 10.0 (critical): Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers…
CVE-2026-39907 — CVSS 10.0 (critical): Unisys WebPerfect Image Suite versions 3.0.3960.22810 and 3.0.3960.22604 expose an unauthenticated WCF SOAP endpoint on TCP port 1208 that…
CVE-2026-27211 — CVSS 10.0 (critical): Cloud Hypervisor is a Virtual Machine Monitor for Cloud workloads. Versions 34.0 through 50.0 arevulnerable to arbitrary host file…
CVE-2026-63343 — CVSS 9.9 (critical): Incus is a system container and virtual machine manager. Prior to version 7.3.0, a malicious image containing a `metadata.yaml` symlink…
CVE-2026-48753 — CVSS 9.9 (critical): Incus is a system container and virtual machine manager. Prior to version 7.1.0, the S3 protocol upload endpoint is vulnerable to path…
CVE-2026-48752 — CVSS 9.9 (critical): Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used…
CVE-2026-48750 — CVSS 9.9 (critical): Incus is a system container and virtual machine manager. Prior to version 7.2.0, the `record-output` parameter of the…
CVE-2026-48749 — CVSS 9.9 (critical): Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image can be used to read or…
CVE-2026-72842 — CVSS 9.9 (critical): luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container…
CVE-2026-72841 — CVSS 9.9 (critical): luci-app-openvpn fails to properly validate the instance_name2 parameter during file upload, allowing authenticated users to perform path…
CVE-2026-14480 — CVSS 9.9 (critical): OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The…
CVE-2026-17184 — CVSS 9.8 (critical): IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote attacker to execute arbitrary code due to external control of file name or path.
CVE-2026-17482 — CVSS 9.8 (critical): IBM Documentation Offline 1.0.0 through 1.4.1 could allow a remote attacker to execute arbitrary code due to improper control of file paths.
CVE-2025-71334 — CVSS 9.8 (critical): Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that…
CVE-2025-71333 — CVSS 9.8 (critical): Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType…
CVE-2026-39006 — CVSS 9.8 (critical): An issue in SNMP4J-Agent 3.8.3 allows a remote attacker to execute arbitrary code via the snmp4jCfgStoragePath component.
CVE-2026-11526 — CVSS 9.8 (critical): GD versions before 2.86 for Perl allow OS command injection and file overwrite via a 2-arg open() of filename arguments in…
CVE-2026-30281 — CVSS 9.8 (critical): An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import…
CVE-2026-30276 — CVSS 9.8 (critical): An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via…
CVE-2020-37080 — CVSS 9.8 (critical): webTareas 2.0.p8 contains a file deletion vulnerability in the print_layout.php administration component that allows authenticated…
CVE-2025-6237 — CVSS 9.8 (critical): A vulnerability in invokeai version v6.0.0a1 and below allows attackers to perform path traversal and arbitrary file deletion via the GET…
CVE-2025-54945 — CVSS 9.8 (critical): An external control of file name or path vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers…
CVE-2025-43951 — CVSS 9.8 (critical): LabVantage before LV 8.8.0.13 HF6 allows local file inclusion. Authenticated users can retrieve arbitrary files from the environment via…
CVE-2025-29709 — CVSS 9.8 (critical): SourceCodester Company Website CMS 1.0 has a File upload vulnerability via the "Create portfolio" file /dashboard/portfolio.
CVE-2025-29708 — CVSS 9.8 (critical): SourceCodester Company Website CMS 1.0 contains a file upload vulnerability via the "Create Services" file /dashboard/Services.
CVE-2024-55372 — CVSS 9.8 (critical): Wallos <=2.38.2 has a file upload vulnerability in the restore database function, which allows unauthenticated users to restore database by…
CVE-2024-55371 — CVSS 9.8 (critical): Wallos <= 2.38.2 has a file upload vulnerability in the restore backup function, which allows authenticated users to restore backups by…
CVE-2024-11838 — CVSS 9.8 (critical): External Control of File Name or Path vulnerability in PlexTrac allows Local Code Inclusion through use of an undocumented API…
CVE-2024-9142 — CVSS 9.8 (critical): External Control of File Name or Path, : Incorrect Permission Assignment for Critical Resource vulnerability in Olgu Computer Systems…
CVE-2024-8517 — CVSS 9.8 (critical): SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. A remote and unauthenticated attacker can execute…
CVE-2023-47862 — CVSS 9.8 (critical): A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. A…
CVE-2023-4634 — CVSS 9.8 (critical): The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and…
CVE-2021-38477 — CVSS 9.8 (critical): There are multiple API function codes that permit reading and writing data to or from files and directories, which could lead to the…
CVE-2026-8043 — CVSS 9.6 (critical): External control of a file name in Ivanti Xtraction before version 2026.2 allows a remote authenticated attacker to read sensitive files…
CVE-2025-53912 — CVSS 9.6 (critical): An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted…
CVE-2026-76158: External Control of File Name or Path in the upload API endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a…
CVE-2026-75913 — CVSS 9.3 (critical): CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The…
CVE-2025-64486: calibre is an e-book manager. In versions 8.13.0 and prior, calibre does not validate filenames when handling binary assets in FB2 files…
CVE-2025-55746 — CVSS 9.3 (critical): Directus is a real-time API and App dashboard for managing SQL database content. From 10.8.0 to before 11.9.3, a vulnerability exists in…
CVE-2026-16926 — CVSS 9.1 (critical): IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to overwrite arbitrary files due to improper neutralization of…
CVE-2026-49441 — CVSS 9.1 (critical): Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.3.0 until 4.14.6 and 5.0.0-beta3, the…
CVE-2026-48162 — CVSS 9.1 (critical): Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta3…
CVE-2026-16054 — CVSS 9.1 (critical): The Drag and Drop Multiple File Upload for WooCommerce WordPress plugin before 1.1.8 does not prevent unauthenticated users from obtaining…
CVE-2026-6070 — CVSS 9.1 (critical): The WP-BusinessDirectory plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Deletion in versions up to and including…
CVE-2026-8450 — CVSS 9.1 (critical): HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's…
CVE-2024-5986 — CVSS 9.1 (critical): A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved…
CVE-2025-65473 — CVSS 9.1 (critical): An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with…