CVE-2026-66493

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

EUVD-2026-54409

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

CVE-2026-66493 Joomla Extension - phoca.cz - Path traversal vulnerability in Phoca Commander 1.0.0-6.1.3

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

CVE-2026-66493

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

CVE-2026-66493

CVE-2026-66493 affects the Joomla extension Phoca Commander (phoca.cz) versions 1.0.0 through 6.1.3. The issue is a path traversal vulnerability caused by improper limitation of paths for delete, copy, and move actions. The CVSS data indicates NETWORK access with low complexity and high privilege...

PT-2026-68887

Name of the Vulnerable Software and Affected Versions Phoca Commander versions 1.0.0 through 6.1.3 Description Improper limitation of paths for delete, copy, and move actions leads to path traversal, a condition where an attacker can access files and directories outside the intended folder by...

CVE-2026-66493: Improper Limitation of a Pathname to a Restricted Directory

Joomla Extension - phoca.cz - Path Traversal vulnerability in Phoca Commander 1.0.0-6.1.3 - Improper limitation of paths for delete, copy and move actions lead to path traversal vulnerabilities...

GHSA-XXPX-F366-4XPQ Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

A control-panel user who holds only the viewCategories permission for a category group and not saveCategories can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action. A read-time authorization grant that a write endpoi...

Craft CMS: Authorization bypass: view-only Categories user can modify category structure via structures/move-element

A control-panel user who holds only the viewCategories permission for a category group and not saveCategories can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action. A read-time authorization grant that a write endpoi...

Incorrect Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Incorrect Authorization through the structures/move-element process. An attacker can alter the ordering and nesting of categories, affecting their URLs and potentially corrupting navigation o...

Malicious code in move-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00077e83bd841dae96e61d432da796cf21839a32e5caf03e7256b2573225335 [email protected] declares a postinstall hook package.json line 7: "postinstall": "node install.js" that runs install.js on npm install. install.j...

MAL-2026-13450 Malicious code in move-bcs-codec (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c00077e83bd841dae96e61d432da796cf21839a32e5caf03e7256b2573225335 [email protected] declares a postinstall hook package.json line 7: "postinstall": "node install.js" that runs install.js on npm install. install.j...

PT-2026-70203

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Description An incorrect authorization issue exists where a control-panel user with only the viewCategories permission, but lacking the saveCategories permission, can permanently modify a category...

PT-2026-76017

A control-panel user who holds only the viewCategories permission for a category group and not saveCategories can permanently modify that group's category structure — reordering and re-parenting categories via the structures/move-element action. A read-time authorization grant that a write endpoi...

K000162766: Linux Kernel PowerPC64s PMD Migration Race Condition vulnerability CVE-2026-53108

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap entries or device-private THP entries. e.g. when movepages is called on a PMD THP page, then...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the move and remove folder operations in FileSystemNotebookRepo. An authenticated attacker with permission to rename notes or use folder operations can supply .. or URL-encoded traversal segments in a note or...

Directory Traversal

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to Directory Traversal through the...

Directory Traversal

Overview codeigniter4/framework is a PHP full-stack web framework that is light, fast, flexible, and secure. Affected versions of this package are vulnerable to Directory Traversal via the move function when handling client-supplied filenames. An attacker can write files outside the intended uplo...

CVE-2026-63222

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...

CVE-2026-63222 CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter is a PHP full-stack web framework. Prior to 4.7.4, calling UploadedFile::move without a second argument uses the client-provided filename without sanitization, allowing a remote attacker to use path traversal sequences to write uploaded content outside the intended directory when the...