Threat database

Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learning Management System (LMS): through 2026-09-18.

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.

CVE-2026-101890 is a stored cross-site scripting (XSS) vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows attackers to inject arbitrary JavaScript code via an unescaped site_title value in a package's footprint.json file. The malicious script executes in an administrator's browser when viewing the Prime Mover Packages list, without requiring package restoration.

CVE-2026-101889 is a path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to delete arbitrary directories by importing a crafted package with manipulated configuration values. This can lead to deletion of critical WordPress directories such as wp-admin, potentially rendering the site inoperable.

CVE-2026-101888 is a path traversal vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows authenticated administrators to write arbitrary files outside the intended extraction directory during ZIP import. This can lead to remote code execution if malicious files are processed by the web environment.

Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions.

CVE-2026-102371 is a medium severity vulnerability in Canonical's Ubuntu Pro for WSL service component before version 0.1.19ubuntu3. The service runs as root inside each WSL instance and attaches the instance to Ubuntu Pro by executing the pro client with the subscription token passed as a command-line argument. On systems where /proc is mounted without process-hiding mitigations (the default in WSL), unprivileged local users can read the token from the command line of the running attach process. This token leakage could allow unauthorized attachment of other machines to the victim's Ubuntu Pro subscription, granting access to Ubuntu Pro services.

Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Common or Default Usernames and Passwords. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Path Traversal. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: from 6.4.101 before 6.4.117.

Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10 and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

CVE-2026-87799 is a critical vulnerability in Canonical LXD affecting versions 4.0.0 up to but not including 4.0.14, 5.0.0 up to 5.0.10, 5.21.0 up to 5.21.8, and 6.0 up to 6.10. It involves improper link resolution in the migration receive path, allowing an authenticated client with certain permissions or a malicious migration source server to write arbitrary files as root on the host. This can lead to full host compromise. The issue is exploited via crafted rsync or btrfs send streams that plant symlinks in transferred volumes.

Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed in 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create custom volumes in a project to copy, and so read, any custom storage volume from any other project on the server, including its snapshots and configuration. The client does this with a crafted request that sets a source volume and source.project but omits source.type.

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is btrfs, the client can also place attacker-controlled content at arbitrary host paths, leading to full host compromise. The client does this with a crafted subvolume path containing ../ sequences, sent in either of two ways: in the optimized_header.yaml of an optimized btrfs backup, or in the btrfs migration header sent by a malicious migration source.

CVE-2026-85526 is a critical path traversal vulnerability in the Btrfs storage driver of Canonical LXD on Linux. It allows an authenticated user with instance creation privileges to delete or replace arbitrary files and directories on the host filesystem with root privileges by exploiting a crafted subvolumes[].path entry in backup/optimized_header.yaml during a btrfs optimized backup import.

Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Contributor SQL Injection in Mollie Forms <= 2.11.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.