CVE-2026-13054

HighCVSS 7.2/10Last modified Aug 28, 2026

Description

A path traversal vulnerability in the WatchGuard Fireware OS Management Web UI allows a privileged authenticated attacker to write arbitrary files on the Firebox's filesystem.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published: Jul 3, 2026
Last modified: Aug 28, 2026
NVD status: Modified

Related CVEs from 2026

CVE-2026-130556.5The `$_internalIndexKey` aggregation expression can be used by any authenticated user to crash a MongoDB server (mongod). The expression fai CVE-2026-130566.5Using expressions that generate large arrays it is possible to craft a query that creates very large intermediate objects in memory, causing CVE-2026-130576.5An issue in the server’s Atlas Search integration allows an authenticated user to bypass per-user access controls. In sharded topologies,CVE-2026-130586.5An authenticated user with basic write privileges can cause the mongod process to terminate abnormally by sending a crafted transaction comm CVE-2026-130598.1An authenticated user with low privileges may be able to perform unauthorized reads and writes on data protected by role-based query-level a CVE-2026-13069.8The midi-Synth plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type and file extension validation in the 'e CVE-2026-130606.5An authenticated user with limited read privileges may be able to access documents from collections they are not authorized to read, due to CVE-2026-130614.3An authenticated user may be able to view session metadata belonging to other users on the system through the $listSessions aggregation stag CVE-2026-130626.5An authenticated user with write privileges on a Queryable Encryption-enabled collection may be able to modify internal encryption metadata CVE-2026-130636.5An authenticated user with standard read/write privileges can cause the mongod process to terminate due to an out-of-memory condition by sen CVE-2026-130646.5Certain query operations involving deeply nested $jsonSchema constructs can trigger disproportionate CPU consumption in affected MongoDB dep CVE-2026-130656.5A user with read-only privileges is able to craft an aggregation pipeline using the $linearFill window function operator with a specific sor