By weakness (CWE)

CWE-22: related vulnerabilities

CVEs classified under CWE-22. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

104 published vulnerabilities · page 2 of 2

• CVE-2026-10264LOW 3.5

  CVE-2026-10264 is a path traversal vulnerability in lharries whatsapp-mcp version 0.0.1, located in the SendMessageRequest function of the Send API Endpoint. An attacker with local access and user privileges can manipulate the mediaPath argument to traverse the file system and read sensitive files, though exploitation impact is limited to information disclosure. The vulnerability has been publicly disclosed.

• CVE-2026-47712LOW 3.3

  Dulwich, a Python library for working with Git repositories, has a path-traversal vulnerability in how it generates patch file names. When creating patch files from Git commits, the library previously used the commit's subject line to create the filename without properly sanitizing it. An attacker could craft a malicious commit with special characters (like slashes, backslashes, or double-dots) in the subject line to trick the library into writing patch files outside the intended directory. This could allow unauthorized file creation in unexpected locations on a system using Dulwich to process untrusted commits.

• CVE-2026-49497LOW 3.3

  Ghidra, the NSA's reverse-engineering framework, contains a path traversal flaw in its debug symbol handler. When you open a malicious ELF binary, Ghidra automatically tries to load debugging information referenced in the binary's .gnu_debuglink section. An attacker can craft that section with path traversal sequences (like "../") to trick Ghidra into checking whether arbitrary files exist on your system and leaking their CRC32 checksums. This is a local attack—the attacker needs you to open a malicious file—but it can reveal information about your system's filesystem structure and contents.

• CVE-2026-12211LOW 2.7

  A path traversal vulnerability has been discovered in Intelbras iNVU 7016 FT running firmware version 3.004.00IB000.0.T (Build 2025-09-26). An attacker with high-level administrative privileges can manipulate requests to the web interface's /RPC2_Loadfile/syslog/ endpoint to access files outside their intended directory. The vulnerability requires authentication and has limited confidentiality impact, but the vendor has already released a patched version. Public exploit code is available, though practical exploitation remains constrained by privilege requirements.