New Ubuntu Desktop Vulnerability Turns Local Access Into Root Control

A vulnerability in snap-confine lets an unprivileged user gain root access on affected Ubuntu Desktop systems. Install the latest snapd update to fix the issue...

libinput: local privilege escalation via crafted uinput devices

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVECMD properties that are executed when a device is removed. This...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

CVE-2026-56844

The CVE concerns the Veeam Updater component within the Veeam Software Appliance. It describes a local privilege escalation that could allow a local user to gain root-level access on the underlying OS. The connected documents confirm the affected component and the impact (elevated privileges to r...

EUVD-2026-47595

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

CVE-2026-56844

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

PT-2026-63274

A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level access to the underlying operating system...

Local Privilege escalation vulnerability in Analog Way Picturall Quad Compact Mark II version 3.5.8

Overview Version 3.5.8 of Analog Way's Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script. Description The Picturall Quad Compact Mark ...

CVE-2026-43945 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution RCE as root. The exploit succeeds even when the platform is configured in its most secure state Secure Mode Enabled an...

CVE-2026-43945

Summary: FUXA versions 1.2.11–1.3.1 are vulnerable to pre-auth RCE via path manipulation in the authentication middleware. An unauthenticated remote attacker can achieve root-level RCE by crafting requests that bypass authentication on Node-RED administrative endpoints through a faulty URL check ...

CVE-2026-63358 FileGator privilege escalation

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...

CVE-2026-63358 FileGator privilege escalation

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...

CVE-2026-63358

Summary of CVE-2026-63358 (FileGator privilege escalation) The affected software is FileGator. The vulnerability arises in the /chmoditems API endpoint, which accepts arbitrary Unix permission values and passes them directly to PHP’s native chmod() via octdec() without validation. This enables an...

CVE-2026-63358 FileGator privilege escalation

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...

FileGator privilege escalation

RISK EVALUATION FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their...

CVE-2026-28316

SolarWinds Serv-U is affected by an insecure direct object reference IDOR vulnerability that can lead to privilege escalation to a system administrator with the ability to execute commands as the root user. This issue requires a domain account with administrator access. The impact is lower in...

CVE-2026-28304

SolarWinds Serv-U is affected by a remote code execution vulnerability that, when exploited, can allow the arbitrary execution of code remotely as root. The impact is lower in Windows deployments...

CVE-2026-64825 Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field...

CVE-2026-64825

CVE-2026-64825 : Home Assistant Core prior to 2026.6.0 contains a path traversal vulnerability reachable during initial onboarding via a crafted backup archive. By manipulating the name field inside the archive’s backup.json to supply an absolute path, the code path using pathlib.Path.truediv dis...