The Prime Mover – Backup and Migration WordPress plugin (versions up to 2.2.1) is vulnerable to PHP Object Injection via unsafe deserialization of untrusted input stored in comment content. An unauthenticated attacker can submit a crafted base64-encoded serialized object through the comment submission endpoint, which is later unserialized without restrictions during plugin export or restore operations. This leads to a critical remote code execution risk without requiring additional plugins or themes.
CVE-2026-93336 is a missing authorization vulnerability in Canonical Juju versions 4.0 through 4.0.15. It allows a controller-authenticated principal, such as a unit agent or a user with only login permission, to read any application's charm resource across any model. This includes sensitive data like container-registry credentials, accessible via a crafted request specifying an arbitrary unit.
CVE-2026-82987 is a vulnerability in the ViewSonic vCast media streaming service used in ViewSonic ViewBoard devices. It involves missing authentication on critical screen capture endpoints (/snapshot or /screen), allowing remote unauthenticated attackers to capture and exfiltrate the current screen content as JPEG images. This affects versions from 0.0.0 up to and including 3.2.715. No CVSS score is provided, and no known exploits are reported in the wild. No patch or official remediation details are currently available from the vendor advisory.
Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local execution and shipping no authentication on its REST/SSE API. Attackers can create a session via POST /sessions and post a message via POST /sessions/{id}/messages without credentials, causing the Deep Agents ReAct loop to run attacker-directed shell commands through the local shell backend, resulting in remote code execution as the server process.
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon allows an established BGP peer to inject FlowSpec rules matching destinations outside the address space authorized by the unicast-route validation procedure. With validation enabled on the receiving flow6 channel, BIRD fails to reject a destination prefix component with a nonzero offset, contrary to RFC 8956 section 5. It validates a reconstructed prefix with zero-filled skipped bits, although the original FlowSpec component can match a broader set of IPv6 addresses. Given a suitable unicast route from the peer, the rule can pass validation and, where export policy permits, be propagated to downstream peers. Downstream enforcement may cause unauthorized traffic filtering or redirection.
CVE-2026-96542 is a vulnerability in the standalone installer for EA Javelin Anticheat on Windows that allows local non-administrative users to elevate privileges to NT AUTHORITY\SYSTEM by modifying the service configuration and executable path. This issue affects specific versions of the standalone installer and requires manual execution outside of standard game installations. The vulnerability is fixed in version 1.0.14940699 and later, with integrated EA game titles automatically repairing service permissions.
CVE-2026-102631 is an improper authentication vulnerability in Canonical's authd before version 0.7.1. The flaw occurs because authd resolves user identity by broker-scoped provider ID but falls back to username matching without rejecting conflicting non-empty provider IDs. This can cause a new user to inherit the previous user's local UID and home directory if an identity provider reassigns an email address. Consequently, the new user can access and modify files, including sensitive credentials like SSH keys and cloud API tokens, belonging to the previous user. Administrators are advised to lock or delete the previous user's local authd account when the corresponding identity provider account is removed.
CVE-2026-45452 is a high-severity vulnerability in Unitronics UniStream Pro (B10 and C10 models) and UniLogic software versions prior to 1.41.329. It involves the use of externally-controlled format strings, which can lead to severe impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or cause denial of service.
CVE-2026-45451 is an improper authentication vulnerability affecting Unitronics UniStream Pro (B10/C10) and UniLogic versions prior to 1.41.329. This flaw allows an attacker with limited privileges to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity rating with a CVSS score of 8.3. No official patch or remediation details are provided in the available data.
CVE-2026-45450 is a high-severity vulnerability in Unitronics UniStream Pro (B10 / C10) and UniLogic versions prior to 1.41.329. It involves improper restriction of operations within the bounds of a memory buffer, classified as CWE-119. This flaw could allow an attacker with low privileges and no user interaction to achieve high impact on confidentiality and integrity, and low impact on availability.
CVE-2026-45449 is an OS Command Injection vulnerability in Unitronics UniStream Pro and UniLogic software. It affects Unitronics UniStream Pro versions B10 and C10, and UniLogic versions prior to 1.41.329. This vulnerability allows improper neutralization of special elements used in OS commands, potentially enabling an attacker with limited privileges to execute arbitrary commands. The CVSS score is 8.3, indicating a high severity impact with high confidentiality and integrity impact and low availability impact.
CVE-2026-100232 is a high-severity vulnerability in SonicWall Network Security Manager (NSM) on-premises. It is an OS command injection flaw that occurs post-authentication and could allow a remote authenticated attacker to execute arbitrary operating system commands, leading to remote code execution.
CVE-2026-96540 is an improper access control vulnerability in SonicWall Network Security Manager (NSM) on-premises export settings. It allows a remote authenticated attacker with limited privileges to potentially access sensitive information. Exploitation may lead to privilege escalation to administrator level or interception of other users' communications within the NSM instance. The vulnerability has a high severity rating with a CVSS score of 8.8.
Swann Communications SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack authentication. This flaw allows an attacker on the local network to access real-time video streams without any authentication. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function) and has a medium severity with a CVSS score of 6.9. No official patch or remediation has been provided in the available data.
Swann Communications SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack authentication. This flaw allows an attacker on the local network to retrieve a live feed snapshot without needing to authenticate. The vulnerability is identified as CWE-306 (Missing Authentication for Critical Function) and has a CVSS 4.0 score of 6.9, indicating medium severity.
SWIFI-SE2KIC devices running firmware version 2.0.22 and earlier have a vulnerability where critical functions lack proper authentication. This flaw allows an attacker on the local network to access the live video feed without needing to authenticate. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and has a medium severity rating with a CVSS 4.0 score of 5.9.
CVE-2026-108185 is a high-severity vulnerability in Zoom Clients involving improper certificate validation in the My Notes feature. This flaw may allow an unauthenticated attacker with network access to disclose sensitive information. The vulnerability does not require user interaction or privileges but has a high attack complexity. No patch or remediation details are provided in the available data.
CVE-2026-108184 is a high-severity vulnerability in certain Zoom Clients for Windows involving improper certificate validation. This flaw may allow an unauthenticated attacker with network access to disclose sensitive information. The vulnerability does not require user interaction and has a high impact on confidentiality. No affected versions or patch information are provided in the available data.