CVE-2026-85185

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

CVE-2026-85185 Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

EUVD-2026-88258

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

CVE-2026-85185 Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root

Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10 on Linux allows an authenticated client with permission to create instances in a project to delete arbitrary files on the host as root. On hosts whose root filesystem is...

CVE-2026-82928

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...

CVE-2026-78424

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

EUVD-2026-88228

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...

CVE-2026-82928

The mH-DEVELOPER smart home module contains a hardcoded SSH public key within /root/.ssh/authorized_keys, which functions as a potential backdoor . Because the SSH daemon starts automatically and permits root login via key authentication, an attacker possessing the matching private key can obtain...

CVE-2026-82928 Undocumented access path in mH-DEVELOPER

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...

CVE-2026-82928 Undocumented access path in mH-DEVELOPER

mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorizedkeys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected devic...

EUVD-2026-88224

Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies write permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enforcer container, which can lead to the...

MAL-2026-17204 Malicious code in @wbnr/design-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3b05ae1cf2f1c184b793a46f4bebd59f7945ef1f671c4e6bd64ee946c416e2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @wbnr/lottiefiles-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f4124e4c91354a00657c25874fb6b9f762438eee2ecd1d8b686af3d4d4ea8c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17212 Malicious code in wbnr-probe-visible-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d776962e1dbbc52e380986c97788bc3fa67272b049d153c25265481ebcd84161 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in @wbnr/design-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3b05ae1cf2f1c184b793a46f4bebd59f7945ef1f671c4e6bd64ee946c416e2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-17205 Malicious code in @wbnr/lottiefiles-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f4124e4c91354a00657c25874fb6b9f762438eee2ecd1d8b686af3d4d4ea8c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wbnr-probe-visible-check (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d776962e1dbbc52e380986c97788bc3fa67272b049d153c25265481ebcd84161 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in kalasnik-npm-simple-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1463688412306d5d6f791bb036bea59aeb7251a3044a52c57119768f27cd463 The package's postinstall script senddata.js runs automatically on npm install. It reads C:\temp\test.txt from the installer's filesystem and POSTs t...

MAL-2026-17206 Malicious code in kalasnik-npm-simple-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1463688412306d5d6f791bb036bea59aeb7251a3044a52c57119768f27cd463 The package's postinstall script senddata.js runs automatically on npm install. It reads C:\temp\test.txt from the installer's filesystem and POSTs t...

Malicious code in kjj81 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be4c29ba9ea960c7f8e350f68be2c3a6dc320bc3e230be0fb6c8f30d186b1417 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...