CVE-2026-73298

The CVE-2026-73298 entry concerns the Microsoft Container Migration Solution Accelerator (multi-service AI-driven migration tool) with vulnerability in version 2.1.2 and earlier. The issue is an authenticated IDOR (Insecure Direct Object Reference) that permits reading, writing, and deleting proc...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

EUVD-2026-57371

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

CVE-2026-73298 Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes

The Microsoft Container Migration Solution Accelerator is a multi-service application that provides a multi-agent, AI-driven migration solution for moving container service configurations to Azure Kubernetes Service. In version 2.1.2 and earlier, a security vulnerability was identified in the...

EUVD-2026-54853

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

CVE-2026-19326

CVE-2026-19326 affects Jevon-Zhong Ai-doctor 0.0.1. The vulnerability is in the deleteImage function of ai-doctor-server/src/filemanagement/filemanagement.service.ts, where manipulating the imagePath argument enables path traversal. Local access is required. The project was informed via an issue ...

CVE-2026-54416

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

EUVD-2026-53192

Pluck CMS through 4.7.21 restricts dangerous file uploads in its admin file-management feature using a fixed blacklist in data/inc/files.php '.php','php3','php4','php5','php6','php7','phtml','.phtm','.pht','.ph3','.ph4','.ph5','.asp','.cgi','.phar', checked against the last 4-5 characters of the...

CVE-2026-15958

The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it also registers for unauthenticated users, allowing an unauthenticated attacker to list, download and upload arbitrary files across the...

EUVD-2026-51393

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, a single-file share event-stream subscription resolves the share root to the owner’s parent folder and subscribes to that folder topic, allowing an authenticated share recipient to receive names, paths, rename targets...

CVE-2026-65891

Affected software: Joomla Extension - joomlacontenteditor.net, Joomla Content Editor (JCE) prior to 2.20.2. Root cause: improper input validation in the file rename functionality, allowing an authenticated user with file-management permissions to rename files to invalid names, resulting in hidden...

CVE-2026-65891 Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor (JCE) < 2.9.99.10

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor JCE 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files t...

PT-2026-65790

Joomla Extension - joomlacontenteditor.net - Creation of hidden files and unintended file overwrite via rename function in Joomla Content Editor JCE 2.20.2 - Improper input validation in the file rename functionality allowed an authenticated user with file management permissions to rename files t...

EUVD-2026-49639

An issue in Dede CMS v.5.7.118 allows a remote attacker to obtain sensitive information via the str parameter of the filemanagecontrol.php component...

CVE-2026-51078

Technical details about CVE-2026-51078 are not publicly provided in the supplied documents. Monitor for updates from NVD/CVE and ENISA sources for affected versions, impact, and remediation.

CVE-2026-52349

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner file management, VehicleSpawner save/folder/rename functionality, WeaponOptions save/folder/rename functionality,...

PT-2026-61602

Name of the Vulnerable Software and Affected Versions Menyoo 2.0 versions prior to commit 729aa48 Description A directory traversal issue allows a local attacker to execute arbitrary code. This occurs through the Spooner file management, the save, folder, and rename functions of the VehicleSpawne...

CVE-2026-52349

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner file management, VehicleSpawner save/folder/rename functionality, WeaponOptions save/folder/rename functionality,...

CVE-2026-52349

Directory Traversal vulnerability in Menyoo 2.0 Versions before commit 729aa48: fixed in commit 729aa48 allows a local attacker to execute arbitrary code via the Spooner file management, VehicleSpawner save/folder/rename functionality, WeaponOptions save/folder/rename functionality,...

CVE-2026-52349

CVE-2026-52349 : Directory traversal vulnerability in Menyoo 2.0 (pre-commit 729aa48). A local attacker could exploit Spooner file management, VehicleSpawner, WeaponOptions, and PedComponentChanger operations to achieve arbitrary code execution. Root cause is path handling in save/folder/rename/c...