CVE-2026-55410

NocoBase (with the @nocobase/plugin-backups) prior to version 2.1.19 is vulnerable. The backups restoration flow interpolates database.schema from _metadata.json into Node.js child_process.exec() shell commands, enabling a backup-management user to execute arbitrary commands with the NocoBase ser...

CVE-2026-55410

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from metadata.json into shell command strings executed with...

CVE-2026-55410 NocoBase backup restore schema name allows command injection

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from metadata.json into shell command strings executed with...

BIT-DISCOURSE-2026-46413 Discourse: Regular users can route multipart uploads into the admin backup store

Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads through ExternalUploadManager into the admin backup store. This issue is fixed in versions 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5...

Le Panthéon de la Souveraineté — Updated!

🏠 Developed on: GitLab | 🪞 Automated mirror on: GitHub 🏛️ The Pantheon of Sovereignty A 100% sovereign, redundant and secure cloud infrastructure, designed to completely break free from GAFAM. Version 1.1: Private network foundation, DNS request encryption for servers DoT and multi-datacenter...

PT-2026-60340

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target...

CVE-2026-55410: Improper Neutralization of Special Elements used in an OS Command

NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.1.19, NocoBase @nocobase/plugin-backups restored PostgreSQL backups by interpolating the database.schema value from metadata.json into shell command strings executed with...

G DATA Total Security Backup Service Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Backup...

EUVD-2026-44083

Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally...

EUVD-2026-43847

Improper link resolution before file access 'link following' in Windows Server Backup allows an authorized attacker to elevate privileges locally...

CVE-2026-50406

Use after free in Windows Backup Engine allows an authorized attacker to elevate privileges locally...

CVE-2026-50364

Improper link resolution before file access 'link following' in Windows Server Backup allows an authorized attacker to elevate privileges locally...

CVE-2026-50406

CVE-2026-50406 affects Windows Backup Engine with a use-after-free vulnerability that enables a locally authenticated attacker to elevate privileges. Connected sources confirm the issue exists in Windows Backup Engine and describe local privilege escalation as the impact, with Microsoft issuing u...

CVE-2026-50406 Windows Backup Engine Elevation of Privilege Vulnerability

...

CVE-2026-50406 Windows Backup Engine Elevation of Privilege Vulnerability

...

CVE-2026-50364 Windows Backup Service Elevation of Privilege Vulnerability

...

CVE-2026-50364

Improper link resolution before file access 'link following' in Windows Server Backup allows an authorized attacker to elevate privileges locally...

CVE-2026-50364

Technical details (affected product/version, root cause, and fixes) are not publicly available in the provided documents. Monitor for updates.

CVE-2026-50364 Windows Backup Service Elevation of Privilege Vulnerability

...

CVE-2026-60114

Sustainable Irrigation Platform SIP through version 5.2.16 contains a path traversal vulnerability that allows attackers with access to the restore functionality to write files to arbitrary locations by uploading crafted JSON backup files with unvalidated keys used to construct file paths...