<span class="text-transparent bg-clip-text bg-gradient-to-r from-brand-purple via-brand-blue to-brand-green">Blog

CVE-2026-72693: kbd openvt Privilege Escalation Enables Passwordless Root Login

The kbd package, shipped on virtually every Linux distribution, contains a local privilege escalation in openvt -u. A flaw in how authenticate_user() verifies process ownership lets an unprivileged user trigger a passwordless login -f root on a new virtual terminal.

CVE-2026-66763: SAP BusinessObjects CMS Stores Credentials Behind a Hardcoded Cryptographic Key

SAP BusinessObjects BI Platform CMS encrypts sensitive credentials with a hardcoded cryptographic key baked into the source code. Anyone with high privileges and local server access can extract and decrypt every stored password.

CVE-2026-44763: Path Traversal in SAP MII Writes Files Outside Intended Directories

SAP Manufacturing Integration and Intelligence fails to validate file paths in certain functions. A privileged attacker can write files outside the intended directory, with high impact across confidentiality, integrity, and availability.

CVE-2026-9318: tablib Stored XSS via HTML Export Dataset Title

tablib, a Python tabular data library with over 147 million PyPI downloads, contains a stored cross-site scripting vulnerability in its HTML export functionality. Attackers can embed JavaScript payloads in dataset titles that execute when the exported HTML file is opened in a browser. Fixed in version 3.10.0.

CVE-2026-12624: HashiCorp Vault LIST Authorization Bypass via Trailing Slash

CVE-2026-12624 lets a Vault token enumerate secrets beneath a path a deny policy was supposed to block. The ACL engine failed to enforce wildcard deny rules on LIST requests with a trailing slash. Fixed in Vault 2.0.3.

CVE-2026-69112: Hugging Face Accelerate Path Traversal Lets Attackers Read Arbitrary Files

Hugging Face Accelerate through 1.14.0 fails to sanitize weight_map entries in sharded checkpoint indexes, allowing arbitrary file reads and denial of service via named pipes. Affects 27M monthly downloads.

CVE-2026-72880: Dokploy Certificate Path Traversal Enables Arbitrary File Write and Remote Code Execution

Dokploy prior to 0.29.13 accepts a user-supplied certificatePath without confinement, allowing authenticated users to write files to arbitrary host locations and achieve remote code execution. Fixed in 0.29.13.

BREAKING: CVE-2026-18500 - @fastify/jwt Key Override Authorization Bypass

CVE-2026-18500 lets @fastify/jwt before 10.2.2 override a route-specific verification key with the global secret, breaking JWT authorization-domain separation. NVD scores it 8.1 HIGH.

HOL

CVE-2026-72842: OpenWrt luci-app-lxc ACL bypass to root code execution

CVE-2026-72842 lets a low-privileged LuCI user reach admin-only container routes in OpenWrt luci-app-lxc, then chains path traversal in the lxc_name parameter to control lxc.hook.start-host and execute code as root on the host.

Aug 14, 2026

CVE-2026-19135: OpenNMS JEXL Measurement Sandbox Bypass

A JEXL sandbox bypass in the OpenNMS Measurements REST API lets a low-privileged authenticated user load arbitrary Java classes on the server (CVSS 5.4, CWE-470). Upgrade to Horizon 36.0.3, Meridian 2024.3.12, or Meridian 2025.0.9.

Aug 13, 2026

CVE-2026-49819: UpSnap Initial-Superuser Takeover Chained to Root RCE

UpSnap 4.4.1 through 5.3.5 lets an unauthenticated network-adjacent attacker claim the initial superuser account on a fresh install, then execute shell commands as root through the wake command handler. Upgrade to 5.4.0.