NI vulnerabilities and threats

Unauthenticated SQL Injection in Books Gallery <= 4.8.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Site Reviews <= 8.3.1 versions.

CVE-2026-93462 is a vulnerability in baserCMS where a critical function lacks proper authentication. This flaw allows a remote attacker to potentially access sensitive information without authorization. The vulnerability affects baserCMS versions prior to 5.3.1 and 5.4.1. The CVSS score is 5.3, indicating a medium severity level.

CVE-2026-93464 is a stored cross-site scripting (XSS) vulnerability in baserCMS that occurs via custom content descriptions. Exploitation of this vulnerability could allow execution of arbitrary scripts in the user's browser. The vulnerability affects baserCMS versions prior to 5.4.1 and 5.3.1. It has a medium severity rating with a CVSS score of 5.4.

CVE-2026-93460 is a stored cross-site scripting (XSS) vulnerability in baserCMS affecting versions prior to 5.4.1 and 5.3.1. The flaw exists in email form fields where appended strings can lead to arbitrary script execution in users' browsers. This vulnerability has a medium severity rating and a CVSS score of 5.4. No known exploits are reported in the wild. No patch or remediation details are provided in the available data.

CVE-2026-93463 is a cross-site scripting (XSS) vulnerability in baserCMS that allows arbitrary script execution in a user's browser due to a script validation bypass. The vulnerability affects baserCMS versions prior to 5.4.1 and 5.3.1. It has a medium severity rating with a CVSS score of 5.4. No known exploits are reported in the wild, and no official patch information is provided.

When converting baserCMS4-style addons to baserCMS5-style ones, BcAddonMigrator includes "config.php" from the addon, which means the PHP code in the file is executed. Arbitrary files on the system may be read or deleted by an administrative user.

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. Either issue undermines package authenticity, and together they allow an attacker to provide packages that appear valid to the system. Even if signature enforcement is restored, the exposed production key enables an attacker to generate signatures that the device will continue to trust. An attacker who can supply a malicious package may be able to execute arbitrary code with root privileges during installation.

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts that value directly into the page as HTML. This behavior allows attacker‑controlled metadata to be interpreted as script content. In addition, the same authenticated origin provides an interface capable of executing system‑level commands with root privileges. An attacker able to influence update metadata could exploit these conditions to execute arbitrary code within the administrative context of the device.

CVE-2026-102371 is a medium severity vulnerability in Canonical's Ubuntu Pro for WSL service component before version 0.1.19ubuntu3. The service runs as root inside each WSL instance and attaches the instance to Ubuntu Pro by executing the pro client with the subscription token passed as a command-line argument. On systems where /proc is mounted without process-hiding mitigations (the default in WSL), unprivileged local users can read the token from the command line of the running attach process. This token leakage could allow unauthorized attachment of other machines to the victim's Ubuntu Pro subscription, granting access to Ubuntu Pro services.

Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

CVE-2026-87799 is a critical vulnerability in Canonical LXD affecting versions 4.0.0 up to but not including 4.0.14, 5.0.0 up to 5.0.10, 5.21.0 up to 5.21.8, and 6.0 up to 6.10. It involves improper link resolution in the migration receive path, allowing an authenticated client with certain permissions or a malicious migration source server to write arbitrary files as root on the host. This can lead to full host compromise. The issue is exploited via crafted rsync or btrfs send streams that plant symlinks in transferred volumes.

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.

CVE-2026-85526 is a critical path traversal vulnerability in the Btrfs storage driver of Canonical LXD on Linux. It allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem with root privileges by exploiting a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.