Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Glances web server exposes a REST API (`/api/4/*`) that is accessible without authentication and allows cross-origin requests from any origin due to a permissive CORS policy (`Access-Control-Allow-Origin: *`). This allows a malicious website to read sensitive system information from a running Glances instance in the victim’s browser, leading to cross-origin data exfiltration. While a previous advisory exists for XML-RPC CORS issues, this report demonstrates that the REST API (`/api/4/*`) is also affected and exposes significantly more sensitive data. Version 4.5.4 patches the issue.
An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive, root-level authentication token by sending an unauthenticated request to the livepatchd.sock Unix domain socket. This vulnerability is exploitable on systems where an administrator has already enabled the Livepatch client with a valid Ubuntu Pro subscription. This token allows an attacker to access Livepatch services using the victim's credentials, as well as potentially cause issues to the Livepatch server.
A vulnerability was found in SonicCloudOrg sonic-server up to 2.0.0. The affected element is the function Upload of the file FileTool.java of the component File Upload Endpoint. The manipulation of the argument Type results in path traversal. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-5495 is a high-severity vulnerability in Labcenter Electronics Proteus version 8.17 SP5. It involves an out-of-bounds write during the parsing of PDSPRJ files, which can lead to remote code execution if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data, allowing an attacker to write beyond allocated memory and execute arbitrary code in the context of the current process. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-5494 is a high-severity vulnerability in Labcenter Electronics Proteus version 8.17 SP5 involving an out-of-bounds write during the parsing of PDSPRJ files. This flaw allows remote attackers to execute arbitrary code by tricking a user into opening a malicious file or visiting a malicious page. The vulnerability arises from improper validation of user-supplied data, leading to a buffer overflow condition. Exploitation requires user interaction. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-5493 is a high-severity vulnerability in Labcenter Electronics Proteus version 8.17 SP5 involving an out-of-bounds write during parsing of PDSPRJ files. This flaw allows remote attackers to execute arbitrary code by convincing a user to open a malicious file or visit a malicious page. The vulnerability arises from improper validation of user-supplied data, leading to a buffer overflow condition. Exploitation requires user interaction and results in code execution with the privileges of the current process.
CVE-2026-5496 is a high-severity vulnerability in Labcenter Electronics Proteus version 8.17 SP5 involving a type confusion flaw in the parsing of PDSPRJ files. This flaw allows remote attackers to execute arbitrary code if a user opens a malicious file or visits a malicious page. Exploitation requires user interaction. The vulnerability arises from improper validation of user-supplied data leading to type confusion and code execution in the context of the current process. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-5412 is a critical improper authorization vulnerability in Canonical Juju versions prior to 2.9.57 and 3.6.21. It allows an authenticated low-privileged user to call the CloudSpec API method in the Controller facade to extract cloud credentials used to bootstrap the controller. This exposure of sensitive credentials can lead to complete compromise of confidentiality, integrity, and availability of the affected system. The issue is fixed in Juju versions 2.9.57 and 3.
Improper synchronization of the userTokens map in the API server in Canonical Juju 4.0.5, 3.6.20, and 2.9.56 may allow an authenticated user to possibly cause a denial of service on the server or possibly reuse a single-use discharge token.
CVE-2026-25203 is a local privilege escalation vulnerability in Samsung MagicINFO 9 Server versions earlier than 21.1091.1. The issue arises from incorrect default permissions, which could allow a local attacker with limited privileges to escalate their access rights. The vulnerability has a high severity rating with a CVSS score of 7.8, indicating significant potential impact on confidentiality, integrity, and availability. There is no vendor-provided patch or official remediation guidance available at this time. No known exploits in the wild have been reported. Users of affected versions should monitor vendor advisories for updates and apply patches once available.
Sonicverse is a Self-hosted Docker Compose stack for live radio streaming. The Sonicverse Radio Audio Streaming Stack dashboard contains a Server-Side Request Forgery (SSRF) vulnerability in its API client (apps/dashboard/lib/api.ts). Installations created using the provided install.sh script (including the one‑liner bash <(curl -fsSL https://sonicverse.short.gy/install-audiostack)) are affected. In these deployments, the dashboard accepts user-controlled URLs and passes them directly to a server-side HTTP client without sufficient validation. An authenticated operator can abuse this to make arbitrary HTTP requests from the dashboard backend to internal or external systems. This vulnerability is fixed with commit cb1ddbacafcb441549fe87d3eeabdb6a085325e4.
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.
In Ubuntu, ubuntu-desktop-provision version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, ubuntu-desktop-provision could include the user's password hash in the attached logs.
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN user to bypass Workplace/Connect Tunnel TOTP authentication.
Improper handling of Unicode encoding in SonicWall SMA1000 series appliances allows a remote authenticated SSLVPN admin to bypass AMC TOTP authentication.
An observable response discrepancy vulnerability in the SonicWall SMA1000 series appliances allows a remote attacker to enumerate SSL VPN user credentials.
Improper neutralization of special elements used in an SQL command (“SQL Injection”) in SonicWall SMA1000 series appliances allows a remote authenticated attacker with read-only administrator privileges to escalate privileges to primary administrator.
CVE-2026-34179 is a critical vulnerability in Canonical LXD versions 4.12 through 6.7 where the doCertificateUpdate function fails to validate the Type field in certificate update requests. This flaw allows a remote authenticated attacker with restricted TLS certificate user privileges to escalate their privileges to cluster admin. The vulnerability has a CVSS score of 9.1, indicating a high severity with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation guidance is currently provided by the vendor. There are no known exploits in the wild at this time.
CVE-2026-34178 is a critical vulnerability in Canonical LXD before version 6.8 where improper input validation allows an authenticated attacker with instance-creation permissions in a restricted project to bypass project restrictions. The vulnerability arises because the backup import process validates project restrictions against one file in the backup archive but creates instances from a separate file that is not checked. This flaw can be exploited to set restricted security settings, potentially leading to full host compromise.
Canonical LXD versions 4.12 through 6.7 have a vulnerability due to an incomplete denylist in the isVMLowLevelOptionForbidden function. This omission allows a remote attacker with can_edit permission on a VM instance in a restricted project to inject AppArmor rules and QEMU chardev configurations. Exploiting this can lead to privilege escalation to LXD cluster administrator and potentially host root. The vulnerability is tracked as CVE-2026-34177 with a critical severity score of 9.1. No official patch or remediation guidance has been provided yet.