CVE
109 articles · page 9 of 10
Part of Security wire
CVE-2026-72842: OpenWrt luci-app-lxc ACL bypass to root code execution
CVE-2026-72842 lets a low-privileged LuCI user reach admin-only container routes in OpenWrt luci-app-lxc, then chains path traversal in the lxc_name parameter to control lxc.hook.start-host and execute code as root on the host.
Michael Kantor
CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files
Hugging Face Accelerate through 1.14.0 fails to sanitize weight_map entries in sharded checkpoint indexes, allowing arbitrary file reads and denial of service via named pipes. Affects 27M monthly downloads.
Michael Kantor
CVE-2026-19135: OpenNMS JEXL Measurement Sandbox Bypass
A JEXL sandbox bypass in the OpenNMS Measurements REST API lets a low-privileged authenticated user load arbitrary Java classes on the server (CVSS 5.4, CWE-470). Upgrade to Horizon 36.0.3, Meridian 2024.3.12, or Meridian 2025.0.9.
Michael Kantor
CVE-2026-49819: UpSnap Initial-Superuser Takeover Chained to Root RCE
UpSnap 4.4.1 through 5.3.5 lets an unauthenticated network-adjacent attacker claim the initial superuser account on a fresh install, then execute shell commands as root through the wake command handler. Upgrade to 5.4.0.
Michael Kantor
CVE-2026-12624: HashiCorp Vault LIST Authorization Bypass via Trailing Slash
CVE-2026-12624 lets a Vault token enumerate secrets beneath a path a deny policy was supposed to block. The ACL engine failed to enforce wildcard deny rules on LIST requests with a trailing slash. Fixed in Vault 2.0.3.
Michael Kantor
CVE-2026-9318: tablib Stored XSS via HTML Export Dataset Title
tablib, a Python tabular data library with over 147 million PyPI downloads, contains a stored cross-site scripting vulnerability in its HTML export functionality. Attackers can embed JavaScript payloads in dataset titles that execute when the exported HTML file is opened in a browser. Fixed in version 3.10.0.
Michael Kantor
CVE-2026-44763: Path Traversal in SAP MII Writes Files Outside Intended Directories
SAP Manufacturing Integration and Intelligence fails to validate file paths in certain functions. A privileged attacker can write files outside the intended directory, with high impact across confidentiality, integrity, and availability.
Michael Kantor
CVE-2026-66763: SAP BusinessObjects CMS Stores Credentials Behind a Hardcoded Cryptographic Key
SAP BusinessObjects BI Platform CMS encrypts sensitive credentials with a hardcoded cryptographic key baked into the source code. Anyone with high privileges and local server access can extract and decrypt every stored password.
Michael Kantor
CVE-2026-72693: kbd openvt Privilege Escalation Enables Passwordless Root Login
The kbd package, shipped on virtually every Linux distribution, contains a local privilege escalation in openvt -u. A flaw in how authenticate_user() verifies process ownership lets an unprivileged user trigger a passwordless login -f root on a new virtual terminal.
Michael Kantor
CVE-2026-6791: glibc wordexp Stack Clash via Tilde Expansion
CVE-2026-6791 is a stack-based buffer overflow in glibc's wordexp() function. The parse_tilde internal function uses strndupa to allocate stack memory sized by attacker input with no bounds check, enabling a stack clash.
Michael Kantor
CVE-2026-38447: osTicket Generates Predictable API Keys via MD5 Hashing (CVSS 9.8)
osTicket 1.18.3 generates API keys using MD5 with predictable inputs (timestamp and client IP). An attacker can approximate the key generation time and brute-force the key space. Affects 5 million+ users and 15,000+ businesses worldwide.
HOL Guard
CVE-2026-18108: Net::SAML2 Authentication Bypass via Unsigned Encrypted Assertions (CVSS 9.8)
Net::SAML2 before 0.86 accepts decrypted SAML assertions that carry no XML signature. Any party can encrypt an unsigned assertion to an SP's published certificate and authenticate as an arbitrary user. Affects Azure AD, Okta, Google, ADFS, and all other IdPs.
HOL GuardRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.