Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent or defeatable authentication mechanisms. Attackers can bypass the weak CRC-16 based unlock handshake or exploit builds with no VUC lock to read and write controller memory and raw flash, persisting implants across power cycles.
Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands, resulting in remote code execution.
A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unauthenticated attacker could potentially exploit this vulnerability to gain unauthorized access to sensitive functionality and perform unauthorized operations.
Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects) allows Code Injection.
This issue affects KIO (Klemsan Internet Objects): before v1.9.
Phison PS3111-S11 controller firmware verifies RSA signatures using a public modulus embedded within the firmware image itself rather than anchored in immutable storage. Attackers can generate arbitrary RSA key pairs, sign modified firmware with the private key, embed the matching modulus in the signature segment, and the controller accepts the tampered firmware as valid.
CVE-2026-66153 is a high-severity vulnerability in the SonicWall NetExtender Linux client. It involves improper handling of temporary files during the NEService auto-upgrade process, allowing an attacker to manipulate file paths due to insecure link resolution before file access. This can lead to unauthorized file access or modification. No patch or official remediation guidance is currently available from the vendor. The vulnerability requires local access with low privileges and has a high attack complexity. There are no known exploits in the wild at this time.
CVE-2026-66152 is a path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component. This flaw allows an attacker to write arbitrary files with root privileges by exploiting improper handling of file paths. The vulnerability has a high severity score of 8.8 and impacts confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.
CVE-2026-66897 is a critical path traversal vulnerability in Canonical's LXD container management software. It allows an attacker with container edit permissions or a user launching a crafted image to overwrite arbitrary files on the host system as root. The flaw arises from a mismatch between path validation and file creation during instance template processing, enabling escape from directory confinement and host root code execution.
FORT Validator versions up to 1.6.7 have an origin validation error in their RRDP processing that allows a delegated CA under the same Trust Anchor Locator to reference another CA's RRDP URLs. This can cause FORT Validator to delete the victim CA's local snapshot and silently remove validated route-origin data, potentially enabling route hijacking or loss of reachability. Version 1.6.8 includes a patch that rejects cross-origin RRDP snapshot and delta URLs. As a workaround, administrators can disable HTTP/RRDP while keeping rsync enabled, though this may cause data unavailability or staleness where rsync is unsupported.
CVE-2026-77113 is a medium severity vulnerability in Canonical Apport affecting versions prior to 2.36.0, 2.34.2, and 2.28.4. It involves a relative path traversal flaw in the apport-unpack component on Linux systems. This flaw allows an attacker to create or overwrite arbitrary files with the privileges of the executing user by manipulating key names in crash report files.
CVE-2026-61898 is an OS command injection vulnerability in Canonical's accountsservice affecting certain Ubuntu-specific language helper scripts. The vulnerability arises because these scripts treat the user-controlled LANGUAGE entry in ~/.pam_environment as trusted input and interpolate it unescaped into a GNU sed replacement expression. This allows an attacker to inject arbitrary shell commands executed with root privileges via the SetLanguage D-Bus method. The issue affects multiple specific versions of accountsservice prior to 23.13.9-8ubuntu7. The vulnerability has a high severity score of 7.8 CVSS v3.1.
CVE-2026-61897 is a local privilege escalation vulnerability in Ubuntu's accountsservice prior to version 23.13.9-8ubuntu7. The flaw arises because an Ubuntu-specific patch only partially drops privileges before launching language helper scripts, leaving the real user ID as root. This allows a shell spawned by the helper script to inherit root privileges and potentially regain full root access. The vulnerability has a high severity with a CVSS score of 7.8.
CVE-2026-68520 is a medium severity vulnerability in the open-source system monitoring tool Glances. Versions prior to 4.5.6 have a flaw in the as_dict_secure() function in glances/config.py, which insufficiently checks option names and inadvertently exposes sensitive information such as public_username and credentials embedded in public_api values. This exposure occurs via unauthenticated GET requests to /api/4/config and /api/4/config/ip endpoints. The issue has been fixed in version 4.5.6.
CVE-2026-68519 is an OS command injection vulnerability in the open-source monitoring tool Glances. Versions prior to 4.5.6 allow execution of shell commands with operators such as redirection, chaining, or pipes when an alert triggers, due to improper handling of the --disable-config-exec flag in GlancesActions.run(). This issue is resolved in version 4.5.6.
CVE-2026-62982 is a high-severity OS command injection vulnerability in the open-source monitoring tool Glances. Versions from 4.5.2 up to but not including 4.5.6 improperly sanitize nested list and dictionary strings in process command line values, allowing malicious pipe characters to be executed via administrator-configured action templates. This flaw is fixed in version 4.5.6.
CVE-2026-68517 is a medium severity vulnerability in the open-source system monitoring tool Glances. Versions prior to 4.5.6 have a permissive cross-domain policy issue in the RESTful API implementation. The vulnerability arises because the CORS origins guard uses exact list equality instead of wildcard membership, allowing a multi-origin list containing a wildcard to retain credentials and expose authenticated API data to untrusted websites. This issue is fixed in version 4.5.6.
Belledonne Communications bcg729 through 1.1.2 contains an out-of-bounds read vulnerability in the decodeSIDframe() function in src/cng.c that allows unauthenticated network-adjacent attackers to trigger a heap read beyond buffer boundaries by sending a zero-length comfort-noise RTP payload. A zero-length payload causes an integer underflow in the uint8_t filter order calculation, which wraps to 255 and is clamped to 10, causing the function to unconditionally read 11 bytes from a zero-byte buffer, resulting in media process termination or silent consumption of adjacent heap memory as reflection coefficients.
CVE-2026-68518 is an OS command injection vulnerability in the open-source system monitoring tool Glances. Versions prior to 4.5.6 improperly sanitize Mustache template variables, allowing attackers to reconstruct shell operators that are executed by the secure_popen() function. This flaw is fixed in version 4.5.6.
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare custom role with the 'settings_view' permission (e.g., Doctor or Receptionist), meaning standard WordPress subscribers cannot exploit this without a KiviCare-assigned role.