CVE-2026-82003: Improper Input Validation

Adobe Campaign Classic ACC is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this vulnerability to execute arbitrary code. Exploit depends on conditions beyond the...

GHSA-JHJP-4C2Q-XMX4 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

The k8saudit plugin's per-container fields ka.req.pod.containers. and the shipped k8sauditrules.yaml evaluated only requestObject.spec.containers. Security-relevant settings on a pod's initContainers or ephemeralContainers were not inspected, so the shipped Create Privileged Pod rule did not fire...

CVE-2026-61749

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-54584

mport , the MidnightBSD Package Manager, prior to version 2.7.8 , used the TMPDIR environment variable when extracting package metafiles, including in privileged (root, setuid/setgid) contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary ...

CVE-2026-54584 mport trusts environment-controlled temporary directories in privileged metadata extraction

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to a...

CVE-2026-15801

CRI-O contains a vulnerability in its container checkpoint and restore feature where insufficient validation of restore metadata may allow a privileged user to perform unintended operations on the host filesystem . Exploitation requires that checkpoint/restore functionality is explicitly enabled ...

CVE-2026-15801 Cri-o: cri-o: insufficient validation during container checkpoint restore

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

EUVD-2026-83843

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-54584: External Control of File Name or Path

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to a...

CVE-2026-61749: Exposure of Sensitive Information to an Unauthorized Actor

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

PT-2026-96044

Name of the Vulnerable Software and Affected Versions Canva Mobile App for HarmonyOS versions prior to 1.15.1 Description The application fails to restrict headers returned to an external origin operating within a privileged WebView. A privileged WebView is a system component that allows the...

Fortinet Privileged Access Agent Authentication Bypass

The vulnerability of the Fortinet Privileged Access Agent for Chrome is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality and integrity of the protected information...

PT-2026-96218

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description Privileged staff users with permissions to author report or label templates can trigger the WeasyPrint report rendering process to retrieve resources selected by an attacker via HTTP, HTTPS, or loc...

PT-2026-96311

Name of the Vulnerable Software and Affected Versions DesktopSMS version 1.11.0 Description An unauthorized access issue exists in the application's local service. Local attackers can interact with this unauthenticated service via same-device loopback to perform privileged SMS operations using th...

PT-2026-96185

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated low-privileged user can overwrite or permanently delete maintenance entry records belonging to other tenants. This occurs because the MaintenanceEntryRepository.Update and...

CVE-2026-88856

OrdaSoft Joomla Gallery extension for Joomla versions

CVE-2026-92252

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files x86\Watchdog...

CVE-2026-92252 Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files x86\Watchdog...