Janus WebRTC Server versions 1.2.3 through 1.4.0 contain a directory traversal vulnerability. The server accepts a user-supplied media path for ondemand streams, validating only the file extension without canonicalization or directory allowlisting. This allows unauthenticated users to cause the server to open arbitrary local files and stream their content as RTP audio.
A spreadsheet formula injection vulnerability exists in Revive Adserver version 6.0.8 and earlier. An unauthenticated attacker can submit conversion values that are interpreted as formulas in exported XLS reports. When users open these reports in spreadsheet applications, the attacker-supplied formulas may be executed. The vulnerability allows formula execution but does not confirm information disclosure. The issue is fixed in version 6.0.9 by sanitizing conversion values before export.
Revive Adserver versions 6.0.8 and earlier contain a stored cross-site scripting (XSS) vulnerability in the maintenance-appendcode-check.php script. This flaw allows an authenticated manager to inject malicious JavaScript by storing a crafted tracker name that appears in the maintenance results page. When an administrator views this page, the injected script executes in their browser due to improper HTML encoding. The vulnerability is addressed in version 6.0.9 by properly encoding tracker names in the maintenance output.
Revive Adserver versions 6.0.8 and earlier contain an authorization bypass vulnerability in campaign-zone linking. This flaw allows an authenticated manager or trafficker with zone-linking permissions to link another agency's campaign to their own zone without proper ownership validation. Although foreign banners cannot be linked due to agency filtering, the unauthorized linking exposes the foreign campaign's name, type, and identifier. The issue is resolved in version 6.0.9 by adding campaign ownership validation.
A reflected cross-site scripting (XSS) vulnerability exists in the invocation-tag generation interface of Revive Adserver version 6.0.8 and earlier. This vulnerability allows an unauthenticated attacker to execute JavaScript in the browser of an authenticated user by tricking them into visiting a specially crafted URL. The issue arises when the Direct Selection feature is enabled, allowing attacker-controlled banner identifiers to be included in HTML form fields without proper encoding. Direct Selection is disabled by default. The vulnerability is fixed in version 6.0.9 by applying HTML encoding to banner identifier values in the invocation-option form fields.
Dell Terraform Provider for Dell PowerFlex contains an OS Command Injection vulnerability in the SDC host provisioning component. A high privileged remote attacker with access to the PowerFlex management plane could exploit this flaw to execute arbitrary OS commands on provisioned SDC hosts, potentially leading to full compromise of those hosts.
An authorization bypass vulnerability exists in channel-edit.php in Revive Adserver version 6.0.8 and earlier. This flaw allows an authenticated manager to create delivery rule sets for agencies other than their own by manipulating the agencyid parameter in the submitted form. The server improperly trusts the submitted agency identifier, enabling unauthorized creation of objects in another agency's account. The issue is resolved in version 6.0.9 by deriving the agency identifier from the authenticated user's account instead of the form data and removing the agency identifier from hidden form fields.
An authorization bypass vulnerability exists in website-index.php in Revive Adserver version 6.0.8 and earlier. This flaw allows an authenticated manager, who is supposed to be restricted to one agency, to view website listings of other agencies by modifying the agencyid request parameter. Although detailed website pages still enforce ownership checks, the disclosed information includes website names, identifiers, and timestamps. The issue is resolved in version 6.0.9 by deriving the agency identifier from the authenticated account rather than the request parameter.
A reflected cross-site scripting (XSS) vulnerability exists in the popup invocation options of Revive Adserver version 6.0.8 and earlier. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of an authenticated user by tricking them into visiting a specially crafted URL. The vulnerability arises because certain request parameters (top, left, timeout, delay) are inserted into HTML attributes without proper encoding. Exploitation requires the presence of an existing popup zone, which can only be created through the administrator API and is not available via the standard zone-creation interface. The issue is resolved in version 6.0.9 by applying HTML encoding to the affected parameters.
A reflected cross-site scripting (XSS) vulnerability exists in updates-history.php in Revive Adserver versions 6.0.8 and earlier. This flaw allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a specially crafted URL. The vulnerability arises because attacker-controlled input is included in XML command attributes without proper encoding. The session check does not cover GET xajax requests, enabling unauthenticated exploitation, and authenticated administrator requests are also affected. The issue is resolved in version 6.0.9 by extending session checks to both GET and POST requests and encoding XML command attribute values in response serializers.
An incorrect authorization vulnerability exists in In Progress® Telerik® Report Server versions prior to 12.3.26.1110. This flaw in the Web Report Designer allows authenticated users with low privileges to perform unauthorized operations on shared report resources, potentially impacting their integrity and availability.
A potential local privilege escalation vulnerability was discovered in Lenovo PC Manager, a software distributed exclusively in the Chinese market. The vulnerability could allow a local user to gain higher privileges on the affected system. The issue was identified during an internal security assessment. No specific affected versions or patch information have been provided. The CVSS score is 7.8, indicating a high severity vulnerability with high impact on confidentiality, integrity, and availability.
An improper permissions vulnerability in Lenovo System Update could allow a local authenticated user to execute code with elevated privileges. This vulnerability has a high severity rating with a CVSS score of 7.3. No specific affected versions or patch information are provided.
The Rooxis RXR-12 Wi-Fi router has an authenticated command injection vulnerability in its LuCI white_list RPC handler. This flaw arises because user-supplied MAC addresses are not properly sanitized before being passed to os.execute(), allowing an attacker with authentication to execute arbitrary root commands. The vulnerability is fixed in firmware version 20260813_c2169ea5, which users can install via the router's local web interface.
A reflected cross-site scripting (XSS) vulnerability exists in the conversion-statistics pages of Revive Adserver version 6.0.8 and earlier. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of an authenticated user by tricking them into visiting a specially crafted URL. The root cause is an incorrect ownership check that validates the advertiser identifier instead of the website identifier, leading to malicious input being rendered without proper encoding. Additionally, the hour parameter is improperly handled. The vulnerability is fixed in version 6.0.9 by correcting the identifier validation and normalizing the hour parameter.
A deserialization of untrusted data vulnerability in Lenovo System Update allows a local authenticated user to execute code with elevated privileges. This vulnerability is identified as CVE-2026-77882 and has a high severity rating with a CVSS score of 7.8. It involves improper handling of serialized data, which can lead to critical impacts on confidentiality, integrity, and availability.
Revive Adserver versions 6.0.0 through 6.0.8 contain an authorization bypass vulnerability that allows an authenticated manager restricted to one agency to access or modify resources of another agency. This occurs due to global input registration prioritizing GET parameters over POST parameters, conflicting with administration forms that use POST. An attacker can supply differing object identifiers in GET and POST requests to bypass permission checks, enabling unauthorized cross-agency changes, campaign ownership reassignment, and disclosure of campaign and banner data. The issue was introduced in a specific commit and fixed in version 6.0.9 by restoring POST parameter precedence.
Kendo UI for jQuery versions from 2026.3.1015 up to, but not including, 2026.4.1110 contain a vulnerability in the PivotGrid and PivotConfigurator components. Axis field names are passed to a chip template without proper encoding, allowing an attacker who can control these field names to execute JavaScript when a user views the rendered chip. This can lead to compromise of data confidentiality and integrity in the user's browser context.
Revive Adserver versions 6.0.8 and earlier contain a stored cross-site scripting (XSS) vulnerability in the report date-selection controls. An unauthenticated attacker can craft a malicious report URL that, after the victim reauthenticates, executes JavaScript in the victim's browser. This occurs because an attacker-controlled period_preset value is stored in the victim's session and inserted into JavaScript without proper encoding. The vulnerability is fixed in version 6.0.9 by applying appropriate JSON encoding to date-selection values.
The Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that can be triggered by a specially crafted AES-128-CBC encrypted magic packet using a static key and IV. This backdoor enables the telnet service with default credentials, granting remote root access. The vendor released firmware version 20260813_c2169ea5 which removes the UDP listener responsible for this backdoor, and users can update via the local web interface.