CVE-2026-2328
High · 7.5CVSS
7.5
EPSS
0.3%
Published
Mar 30, 2026
CISA due date
—
The record
An unauthenticated remote attacker can exploit insufficient input validation to access backend components beyond their intended scope via path traversal, resulting in exposure of sensitive information.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-11331 An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies… CWE-790
- CVE-2026-9658 Plack::Middleware::Security::Common versions before 0.13.1 for Perl did not block header… CWE-790
- CVE-2025-27260 Ericsson Indoor Connect 8855 versions prior to 2025.Q3 contains an Improper Filtering of… CWE-790
- CVE-2025-15576 If two sibling jails are restricted to separate filesystem trees, which is to say that… CWE-790
- CVE-2024-43442 Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site… CWE-790
- CVE-2024-43443 Improper Neutralization of Input done by an attacker with admin privileges ('Cross-site… CWE-790