KEV 2026.10.301,766 entries+10 in 7d11 open federal deadlinesas of / search ? keys
KEV Now

Weakness / #6

CWE-22: Path traversal in CISA KEV

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Catalog
2026.10.30
Rank
#6 of 198
MITRE
CWE-22 definition

Answer 82 KEV entries list CWE-22 (Path traversal) as of catalog 2026.10.30, 4.6% of the catalog and rank 6 of 198 weaknesses. The most affected vendor is Fortinet (4).

Crafted file paths such as ../ let an attacker read or write files outside the intended directory.

KEV entries
824.6% of catalog
Vendors
56affected
Ransomware: known
2732.9%
First added
2021-11-03
Latest added
2026-10-16

VVendors

Vendors with CWE-22 KEV entries
VendorEntriesShare
Fortinet44.9%
Rails33.7%
SAP33.7%
Atlassian33.7%
Ivanti33.7%
Apache33.7%
Adobe22.4%
Cisco22.4%
Samsung22.4%
SimpleHelp 22.4%
RARLAB22.4%
Mitel22.4%

TAdditions by year

CWE-22 KEV additions per yearColumn chart of KEV additions per calendar year. 2021: 20; 2022: 22; 2023: 4; 2024: 9; 2025: 13; 2026: 14.01020302021: 20 added2020212022: 22 added2220222023: 4 added420232024: 9 added920242025: 13 added1320252026: 14 added (year to date)142026
CWE-22 KEV additions by year
YearAdded
202120
202222
20234
20249
202513
202614

PProducts

Products with CWE-22 KEV entries
ProductEntriesShare
Rails Ruby on Rails33.7%
Adobe ColdFusion22.4%
Samsung MagicINFO 9 Server22.4%
SimpleHelp SimpleHelp22.4%
SAP NetWeaver22.4%
Mitel MiCollab22.4%
DrayTek VigorConnect22.4%
Fortinet FortiOS22.4%

EAll entries

KEV entries listing CWE-22
CVEVendorProductAddedRansomware
CVE-2025-61624FortinetMultiple ProductsUnknown
CVE-2021-3199ONLYOFFICEDocsUnknown
CVE-2026-104286FortinetFortiMailUnknown
CVE-2026-93616Check PointMultiple ProductsUnknown
CVE-2026-66384JFrogArtifactoryUnknown
CVE-2026-59310BroadcomVMware vCenterKnown
CVE-2026-48282AdobeColdFusionUnknown
CVE-2026-34909UbiquitiUniFi OSUnknown
CVE-2026-20262CiscoCatalyst SD-WAN ManagerUnknown
CVE-2024-1708ConnectWiseScreenConnectKnown
CVE-2024-7399SamsungMagicINFO 9 ServerUnknown
CVE-2024-57728SimpleHelp SimpleHelpKnown
CVE-2025-2749KenticoKentico XperienceUnknown
CVE-2025-8110GogsGogsUnknown
CVE-2025-6218RARLABWinRARUnknown
CVE-2021-43798Grafana LabsGrafanaUnknown
CVE-2019-5418RailsRuby on RailsUnknown
CVE-2024-0769D-LinkDIR-859 RouterUnknown
CVE-2025-4632SamsungMagicINFO 9 ServerUnknown
CVE-2025-27920SrimaxOutput MessengerUnknown
CVE-2023-38950ZKTecoBioTimeUnknown
CVE-2025-34028CommvaultCommand CenterUnknown
CVE-2017-12637SAPNetWeaverUnknown
CVE-2024-4885ProgressWhatsUp GoldUnknown
CVE-2024-57727SimpleHelp SimpleHelpKnown
CVE-2024-55550MitelMiCollabKnown
CVE-2024-41713MitelMiCollabKnown
CVE-2024-11667ZyxelMultiple FirewallsKnown
CVE-2021-26086AtlassianJira Server and Data CenterUnknown
CVE-2019-16278NostromonhttpdUnknown
CVE-2024-8963IvantiCloud Services Appliance (CSA)Unknown
CVE-2024-7262KingsoftWPS OfficeUnknown
CVE-2021-20124DrayTekVigorConnectUnknown
CVE-2021-20123DrayTekVigorConnectUnknown
CVE-2024-32113ApacheOFBizUnknown
CVE-2024-28995SolarWindsServ-UUnknown
CVE-2023-47246SysAidSysAid ServerKnown
CVE-2023-32315Ignite RealtimeOpenfireUnknown
CVE-2023-35081IvantiEndpoint Manager Mobile (EPMM)Unknown
CVE-2022-41328FortinetFortiOSUnknown
CVE-2018-5430TIBCOJasperReportsUnknown
CVE-2018-18809TIBCOJasperReportsUnknown
CVE-2022-26500VeeamBackup & ReplicationKnown
CVE-2022-41352SynacorZimbra Collaboration Suite (ZCS)Known
CVE-2022-26352dotCMSdotCMSKnown
CVE-2020-36193PEARArchive_TarUnknown
CVE-2022-27925SynacorZimbra Collaboration Suite (ZCS)Known
CVE-2022-30333RARLABUnRARKnown
CVE-2019-7195QNAPPhoto StationKnown
CVE-2019-7194QNAPPhoto StationKnown
CVE-2015-0016MicrosoftWindowsUnknown
CVE-2022-29464WSO2Multiple ProductsKnown
CVE-2014-0780InduSoftWeb StudioUnknown
CVE-2019-7483SonicWallSMA100Unknown
CVE-2020-1631JuniperJunos OSUnknown
CVE-2016-0752RailsRuby on RailsUnknown
CVE-2015-4068ArcserveUnified Data Protection (UDP)Unknown
CVE-2015-3035TP-LinkMultiple Archer DevicesUnknown
CVE-2015-0666CiscoPrime Data Center Network Manager (DCNM)Unknown
CVE-2014-0130RailsRuby on RailsUnknown
CVE-2010-2861AdobeColdFusionKnown
CVE-2020-14864OracleIntelligence Enterprise EditionUnknown
CVE-2018-14847MikroTikRouterOSUnknown
CVE-2021-42013ApacheHTTP ServerKnown
CVE-2021-41773ApacheHTTP ServerKnown
CVE-2021-40444MicrosoftMSHTMLKnown
CVE-2021-36741Trend MicroApex One, Apex One as a Service, and Worry-Free Business SecurityUnknown
CVE-2021-20090ArcadyanBuffalo FirmwareUnknown
CVE-2021-20023SonicWallSonicWall Email SecurityKnown
CVE-2020-5902F5BIG-IPKnown
CVE-2020-4430IBMData Risk ManagerUnknown
CVE-2020-11738WordPressSnap Creek Duplicator PluginUnknown
CVE-2020-11652SaltStackSaltUnknown
CVE-2019-3398AtlassianConfluence Server and Data CenterUnknown
CVE-2019-3396AtlassianConfluence Server and Data ServerKnown
CVE-2019-20085TVTNVMS-1000Unknown
CVE-2019-19781CitrixApplication Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKnown
CVE-2019-18187Trend MicroOfficeScanUnknown
CVE-2019-11510IvantiPulse Connect SecureKnown
CVE-2018-2380SAPCustomer Relationship Management (CRM)Known
CVE-2018-13379FortinetFortiOSKnown
CVE-2016-3976SAPNetWeaverUnknown

Cite this

82 CISA KEV entries list CWE-22 (Path traversal), 4.6% of the catalog. Source: KEV Now analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.10.30 (released 2026-10-30). https://kevnow.com/cwe/cwe-22/

Source: CISA KEV catalog v2026.10.30, released 2026-10-30. Windows end 2026-10-30.

Keyboard shortcuts

Keyboard shortcuts
/Focus search
?Show this panel
EscClose panel or clear search
g dGo to Dashboard
g kGo to KEV
g vGo to Vendors
g pGo to Products
g wGo to Weaknesses
g sGo to Stats
g rGo to Regulations
g bGo to Briefings