CVE-2026-32645 is a vulnerability in Red Lion Controls 700 Series where default factory credentials with administrative access remain enabled and persist even after other administrator accounts are configured. This allows an attacker with local access and high privileges to potentially gain unauthorized administrative control. The vulnerability has a medium severity with a CVSS score of 6. No patch or remediation information is currently provided.
A NULL pointer dereference in the illumos Network Auto-Magic daemon (nwamd) allows a local user to crash the daemon. nwamd_door_switch() in usr/src/cmd/cmd-inet/lib/nwamd/door_if.c writes to the caller's request structure before checking that a request was supplied, and before checking the caller's credentials. Because the nwamd door at /etc/svc/volatile/nwam/nwam_door is accessible to all local users, an unprivileged user can issue a door_call() with no argument data to crash nwamd; repeated calls place the svc:/network/physical:nwam service into maintenance, stopping automatic network configuration. nwamd runs only when svc:/network/physical:nwam is enabled, which is not the default. The flaw has existed since 2010 (illumos-gate commit 6ba597c5), and affects any illumos distribution prior to illumos-gate commit 0f1064d9.
A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local user, including one in a non-global zone, can repeatedly pass a descriptor to its zone's nscd in a door_call() loop, causing the file descriptor table of nscd to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. The flaw has existed since 2006 (illumos-gate commit cb5caa98), and affects any illumos distribution prior to illumos-gate commit af810a72.
A missing authorization check in the illumos zones statistics daemon (zonestatd) allows a local user in any zone to disrupt zonestat in other zones and to determine which zones are running. The zonestatd door server procedure, zsd_server() in usr/src/cmd/zonestat/zonestatd/zonestatd.c, handles the ZSD_CMD_NEW_ZONE command, which is intended to be sent by zoneadmd, without checking the caller's credentials. Because the zonestatd door is accessible to all users in every zone, an unprivileged user can send this command with an arbitrary zone ID, causing zonestatd to re-create its door file in that zone, so that new zonestat requests in that zone can fail while the file is replaced. The time taken to handle the command also reveals whether a given zone ID belongs to a running zone. The flaw has existed since 2010 (illumos-gate commit efd4c9b6), and affects any illumos distribution prior to illumos-gate commit 865b58d2.
A missing authorization check in the illumos IP management daemon (ipmgmtd) allows a local user to change the persistent IP multipathing (IPMP) configuration. The ipmgmtd door dispatch table in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c does not require the solaris.network.interface.config authorization for the IPMGMT_CMD_IPMP_UPDATE command, although its handler, ipmgmt_ipmp_update_handler(), writes to the persistent ipadm configuration when the IPMGMT_PERSIST flag is set. An unprivileged local user can therefore add interfaces to, or remove them from, existing IPMP groups in the stored configuration. The running configuration is not changed; the modification takes effect when the stored configuration is next applied, such as at boot, and may disrupt network connectivity. The flaw has existed since 2021 (illumos-gate commit a73be61a), and affects any illumos distribution prior to illumos-gate commit e8d3efa1.
KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in KodArchive.class.php lacking the PCLZIP_OPT_EXTRACT_DIR_RESTRICTION option. Authenticated attackers can upload a malicious ZIP archive with traversal sequences to overwrite arbitrary files such as core JavaScript assets, enabling stored XSS that leads to admin account takeover and subsequent remote code execution via unrestricted PHP file upload.
CVE-2026-102916 is a reachable assertion vulnerability in the illumos bhyve instruction emulator that allows a guest VM to cause the host to panic. The issue arises when emulating REP-prefixed MOVS or STOS instructions accessing guest MMIO, where a status flag is not cleared properly, leading to a VERIFY assertion failure and host panic. A privileged user inside a guest VM can exploit this to cause denial of service to the host and all other guests. The flaw has existed since 2020 and affects illumos distributions prior to a specific commit fixing the issue.
HortusFox (hortusfox-web) versions up to 6.3 have an unrestricted file upload vulnerability in the PlantAttachmentModel component. Authenticated users can upload files with arbitrary extensions to the public attachments directory. This allows uploading of HTML or SVG files that can lead to stored cross-site scripting (XSS), or PHP files that may execute code if .htaccess restrictions are not enforced.
HortusFox (hortusfox-web) versions before 6.2 contain an SQL injection vulnerability in the /api/locations/list endpoint. The flaw allows API token holders to inject SQL via crafted include_info values, enabling unauthorized reading of database tables including user password hashes. This vulnerability has a high severity score of 7.1 and does not require user interaction or privileges beyond API token access.
The openPDC Docker image from Grid Protection Alliance contains a fixed administrative credential that is not forced to be changed on first use. This allows an attacker with network access to the management interface to authenticate with the default credential and gain full administrative control. The vulnerability affects versions prior to 2.9.477 and 2.9.482. It has a critical CVSS score of 9.8.
This report discusses the security risks posed by AI agents using valid credentials to perform actions beyond their assigned permissions, particularly in corporate environments. It highlights how traditional access controls may fail to prevent agents from escalating privileges by switching to more powerful credentials available on the same system. The article outlines various enforcement points and mitigation strategies to limit agent actions without sacrificing autonomy, including managed agent settings, runtime hooks, gateways, sandboxes, endpoint enforcement, and credential authorization. It emphasizes the importance of scoping agent permissions tightly and enforcing controls at the tool call level to prevent unauthorized actions. The report does not describe a specific vulnerability or exploit but rather addresses a broader security challenge in managing AI agent permissions.
CVE-2026-94067 is a high severity vulnerability in Fuelthemes The Voux WordPress theme that allows improper control of filenames used in include/require statements, leading to PHP Remote File Inclusion (RFI). This vulnerability affects versions from 0 up to and including 6.9.5. Exploitation could result in remote code execution and full compromise of the affected system. No patch or remediation information is provided in the available data.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.
CVE-2026-94065 is a high-severity vulnerability in BuddhaThemes ColorFolio plugin (colorit component) that allows deserialization of untrusted data leading to object injection. This affects versions from 0 up to and including 1.3. The vulnerability can result in full compromise of confidentiality, integrity, and availability of the affected system.
CVE-2026-94064 is a high-severity vulnerability in the BuddhaThemes Neo | Barber Shop WordPress Theme (versions up to 3.5). It involves deserialization of untrusted data that allows object injection, potentially leading to full compromise of confidentiality, integrity, and availability.
A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.
A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.
CVE-2026-85479 is a medium severity vulnerability in the Grid Protection Alliance openPDC product. The STTP-based data publisher component accepts network connections without requiring authentication by default. This allows an unauthenticated attacker on the network to connect and exchange data with the interface.
CVE-2026-105281 is a vulnerability in the Grid Protection Alliance openPDC product where the internal data publisher accepts network connections without authentication by default. This allows an unauthenticated attacker to connect remotely and retrieve the full device and measurement topology of the system. The vulnerability affects multiple versions prior to 2.9.477, 2.9.482, 2.8.580, and 2.8.585. The CVSS 3.1 base score is 7.5, indicating high severity due to the ability to obtain sensitive configuration information without privileges.