CVE-2026-79667: Improper Authorization

Ech0 version 4.3.4 and earlier fails to reliably enforce scoped access token least-privilege restrictions on several privileged admin routes. Multiple privileged endpoints e.g., /api/inbox, /api/panel/comments, /api/backup/export omit scope checks and authorize based only on the user's admin role...

CVE-2026-47753

A flaw was found in Incus, a system container and virtual machine manager. An authenticated user with permissions to create instances in any project can remotely trigger a nil-pointer dereference by uploading a specially crafted backup tarball. This vulnerability causes the Incus daemon to panic...

CVE-2026-48754

A flaw was found in Incus, a system container and virtual machine manager. An authenticated user with cancreateinstances permission can crash the incusd daemon by uploading a specially crafted instance backup tarball. This vulnerability, a nil-pointer dereference, leads to a Denial of Service DoS...

CVE-2026-48756

A flaw was found in Incus, a system container and virtual machine manager. An authenticated user with cancreatestoragevolumes permission can crash the incusd daemon. This occurs by uploading a crafted backup tarball where the volumesnapshots.expiresat field is absent, leading to an unguarded...

tplink-archer-root-exploit

TP-Link Archer AX73 / AX10 — Root Shell Exploit Auto-Mail L...

CVE-2026-70460

A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary...

Exploit for CVE-2025-40123

Patch: CVE-2025-40123 Vulnerability Details - CVE: CVE...

rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink

...

CVE-2026-55168

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

EUVD-2026-64143

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168 Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168 Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168 Runtipi: Authenticated arbitrary file write via backup restore symlink planting

Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...

CVE-2026-55168

Runtipi (personal homeserver orchestrator) versions 4.10.0 and earlier are vulnerable to an authenticated arbitrary file write via symlink planting during the backup restore flow. An attacker with valid credentials can craft a backup archive containing a symlink (e.g., user-config/app.env pointin...

CVE-2026-48755

Incus is a system container and virtual machine manager. Prior to version 7.1.0, improper validation of user-provided backup compression algorithm leads to argument injection in the constructed command line. This leads to an arbitrary file write on the host, possibly leading to arbitrary command...

CVE-2026-48756

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateCustomVolumeFromBackup in internal/server/storage/backend.go contains an unguarded time.Time dereference on the ExpiresAt field of every volume-snapshot entry in an imported custom-volume backup. An...

CVE-2026-47753

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.CreateInstanceFromBackup in internal/server/storage/backend.go contains a nil-pointer dereference that an authenticated user with permission to create instances in any project can trigger remotely by uploadin...

CVE-2026-48752

Incus is a system container and virtual machine manager. Prior to version 7.2.0, a specially crafted image or instance backup can be used to read or create/write arbitrary files on the host; possibly leading to arbitrary command execution. Version 7.2.0 patches the issue...

CVE-2026-48754

Incus is a system container and virtual machine manager. Prior to version 7.1.0, backend.createDependentVolumesFromBackup in internal/server/storage/backend.go contains a cluster of unguarded pointer derefs on every dependent-volume entry's VolumeSnapshotsi, Volume, and Pool sub-fields. An...

CVE-2026-63125

Incus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-confined Incus user a non-admin TLS/RBAC identity with cancreateimages and cancreateinstances can execute arbitrary code as root on the host. A crafted image ships backup.yaml as a symlink to...