CVE-2026-15929 is a high-severity SQL injection vulnerability in LG Electronics SmartShare affecting versions up to and including 2.3.1712.1202. The flaw involves improper neutralization of special elements in SQL commands, which could allow an attacker to manipulate database queries. This vulnerability affects SmartShare running on Microsoft Windows 10 and earlier versions. No official patch or remediation guidance has been provided yet.
The Advanced Responsive Video Embedder plugin for WordPress version 10.8.7 contains a critical authentication bypass vulnerability due to a hardcoded backdoor token. This backdoor allows unauthenticated attackers to gain administrator privileges by supplying a known token that matches a hardcoded SHA-256 hash in the plugin source. The vulnerability arises because the authentication bypass occurs before any normal authentication checks, with no nonce or capability verification. This flaw was likely introduced maliciously by an attacker with commit access to the plugin's codebase.
Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina – Charts and Graphs For Elementor: from n/a through 3.1.12.
CVE-2026-8933 is a local privilege escalation vulnerability in snap-confine, a core component used by Canonical snapd to create secure execution environments for snap applications. The flaw affects versions of snap-confine configured with set-capabilities rather than set-uid-root. An unprivileged local attacker can exploit this vulnerability to bypass security restrictions and execute arbitrary code with full root privileges. The vulnerability has a high severity score of 7.8 and impacts version 2.75.0. No official patch or remediation guidance is currently available.
CVE-2026-15226 is a high-severity vulnerability in Canonical snapd's snap-confine component that allows sandbox confinement bypass. The issue arises because the seccomp security templates do not block operations that create or manipulate set-user-ID (setuid) executables. This enables a confined snap application to compile or drop binaries with setuid attributes, potentially allowing privilege escalation within the container namespace. The vulnerability has been addressed by hardening the seccomp template engine to block such actions. Versions prior to 2.76.1 are affected.
An access control bypass and information disclosure vulnerability exists in the base AppArmor security profile configuration of Canonical snapd. The abstraction rules located in /etc/apparmor.d/abstractions/nss-systemd (inherited via ) inadvertently permit strictly confined snap applications, which lack the privileged account-control interface, to interact directly with the io.systemd.Multiplexer and io.systemd.NameServiceSwitch UNIX domain sockets under /run/systemd/userdb/.
On systems where the systemd-userdbd service is installed and operational, the service fails to distinguish between an unconfined root user on the host system and a restricted root user running within a snap application's sandbox (such as a daemon or configuration hook). Because systemd-userdbd returns "complete" user records—including sensitive hashed user passwords from /etc/shadow—when queried by a process running as root, a compromised or malicious strictly confined snap executing code as root can successfully query the Varlink interface to retrieve all system password hashes, bypassing intended snap sandbox restrictions. This issue is mitigated by the fact that systemd-userdbd is not installed by default on standard Ubuntu deployments.
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama allows SQL Injection.
This issue affects Turkhotspot 5651 Loglama: from 5.1.2 before 5.1.3.
CVE-2026-53412 is a critical vulnerability in Zoom Workplace for Windows and related Zoom clients that involves improper input validation. This flaw may allow an unauthenticated attacker with network access to take over user accounts. The vulnerability affects Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows. No specific affected versions or patches have been confirmed yet. The vulnerability has a CVSS score of 9.8, indicating a critical severity level.
CVE-2026-53411 is a high-severity vulnerability in the Zoom Workplace VDI Plugin for Windows. It involves a time-of-check to time-of-use (TOCTOU) race condition during the installation and uninstallation processes. This flaw could allow an authenticated local user to escalate privileges on the affected system. No specific affected versions or patches have been disclosed yet.
CVE-2026-53410 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the installation and uninstallation process of certain Zoom Clients for Windows. This flaw could allow an authenticated local user to escalate privileges on the affected system. The vulnerability has a high severity rating with a CVSS score of 7. No specific affected versions or patches have been disclosed yet.
CVE-2026-53409 is a high-severity vulnerability in Zoom Communications Zoom Rooms for Windows prior to version 7.1.0. It involves improper privilege management that may allow an authenticated local user to escalate their privileges. The vulnerability is classified under CWE-20 (Improper Input Validation). No patch or official remediation guidance is currently provided by the vendor.
An insecure symlink following vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools) within the pro collect-logs command framework. The utility creates or utilizes predictable temporary file paths or user-accessible log directories when gathering diagnostic information without verifying the file type or ownership. An unprivileged local attacker can exploit this behavior by creating a symbolic link (symlink) at a predictable destination path pointing to an arbitrary, root-readable file (such as /etc/shadow or private files within /root). When a root administrator or operator subsequently executes the pro collect-logs command, the tool follows the user-controlled symlink, reads the target file, and compresses its contents into the resulting diagnostic support archive. Because the output archive remains readable by the unprivileged user, the attacker can extract and read the sensitive root-owned files, leading to a complete information disclosure of system secrets.
An input validation and injection vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client constructs APT source files (such as /etc/apt/sources.list.d/ubuntu-.list or their DEB822 equivalents) using data received directly from the contract server response via the directives.suites[] and directives.aptURL fields. Because the client utilizes Python's str.format() to write these files without performing escaping, validation, or newline character filtering, a malicious or tampered contract response containing embedded newline (\n) characters can successfully inject arbitrary, attacker-controlled deb configuration lines into root-owned APT sources. When combined with the unvalidated additionalPackages[] field—which is passed positionally into a root-executed apt-get install command—an attacker capable of spoofing or manipulating the contract response (e.g., via a compromised internal infrastructure, an intercepted connection utilizing a trusted CA, or local logical bugs) can force the client to fetch and install malicious packages. This ultimately leads to arbitrary code execution with root privileges on the affected system. This component is preinstalled on supported Ubuntu Server releases and auto-attaches by default on cloud provider Ubuntu Pro images.
An information disclosure vulnerability exists in Canonical ubuntu-pro-client (formerly ubuntu-advantage-tools). The client validates Ubuntu Pro APT credentials by executing /usr/lib/apt/apt-helper using the download-file command. During this process, the secret bearer token is embedded directly in
the cleartext URL component passed via the command-line arguments (argv), resulting in a URL format such as https://bearer:<token>@esm.ubuntu.com/.../. On systems utilizing a default-mounted /proc file system where process-hiding mitigations (such as hidepid) are disabled, an unprivileged local attacker can
monitor system processes and read the sensitive bearer token directly from /proc/cmdline while the helper process is actively running. This leaked token can subsequently be used to gain unauthorized access to the victim's Ubuntu Pro or Expanded Security Maintenance (ESM) repositories.
Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
CVE-2026-15409 is a critical Server-Side Request Forgery (SSRF) vulnerability in the SonicWall SMA1000 Appliance Work Place interface. It allows a remote unauthenticated attacker to cause the appliance to make requests to unintended locations. The vulnerability affects specific versions of SMA1000 firmware. Exploitation can lead to complete compromise of confidentiality, integrity, and availability. Known exploits and ransomware campaigns have been reported leveraging this vulnerability.
CVE-2026-15497 is a code injection vulnerability in SonicCloudOrg's sonic-agent affecting versions 2.7.0, 2.7.1, and 2.7.2. The issue exists in an unspecified function within the JWT Authentication Filter component of the ExchangeController.java file. This vulnerability can be exploited remotely without authentication. The vendor no longer supports these product versions and has not responded to the vulnerability disclosure. No official patch or remediation is currently available.
A vulnerability was found in SonicCloudOrg sonic-agent up to 2.7.2. The impacted element is the function evalIsFailed of the file sonic-agent/src/main/java/org/cloud/sonic/agent/tests/script/GroovyScriptImpl.java of the component Groovy Script Handler. The manipulation results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.
A vulnerability has been found in SonicCloudOrg sonic-agent up to 2.7.2. The affected element is an unknown function of the file AndroidWSServer.java of the component Android WebSocket Server. The manipulation of the argument path leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This vulnerability only affects products that are no longer supported by the maintainer.