EUVD-2026-91775

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392 RPC secret disclosure via vendor data endpoint in Canonical MAAS

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12392

An information exposure vulnerability exists in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 . An unauthenticated attacker can retrieve the RPC secret in plaintext via the vendor data metadata endpoint . This is specifically possible if a target machine was deployed wi...

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

Summary A malicious or compromised Composer package could, when installed as a dependency, cause Composer to change the permissions of a file outside that package's own directory and to register a runnable vendor/bin command that points at that outside file. This is a path traversal and link...

EUVD-2026-80863

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

EUVD-2026-91246

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951 MultiVendorX <= 5.0.18 - Authenticated (Store Manager+) SQL Injection via 'order_by' Parameter

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-12951

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection in versions up to and including 5.0.18 . The flaw exists in the order_by parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint. The root cause is the direct concatenation of user-supplied input i...

PT-2026-104126

Name of the Vulnerable Software and Affected Versions Dc Woocommerce Multi Vendor versions prior to 5.0.19 Description An issue exists where authenticated attackers with vendor-level access or higher specifically those with the edit stores capability can perform SQL Injection. This occurs because...

CVE-2026-12392: Exposure of Sensitive Information to an Unauthorized Actor

An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option...

CVE-2026-12951: Improper Neutralization of Special Elements used in an SQL Command

The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter of the /multivendorx/v1/compliance/report-abuse REST endpoint in versions up to and including 5.0.18. This is due to insufficient escaping on the user supplied parameter and lack of...

PT-2026-104426

Name of the Vulnerable Software and Affected Versions Canonical MAAS versions prior to 3.4.10 Canonical MAAS versions prior to 3.5.14 Canonical MAAS versions prior to 3.6.5 Canonical MAAS versions prior to 3.7.3 Canonical MAAS versions prior to 3.8.0 Description An information exposure issue allo...

SUSE CVE-2026-97027

Flatpak passes through arbitrary vendor-extension keys unmodified when exporting an application's Desktop Entry .desktop and D-Bus Service .service files, instead of validating against an allowlist. A malicious Flatpak app can use this to cause denial of service e.g. forced application restart...

Linux Distros Unpatched Vulnerability : CVE-2026-100798

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

Linux Distros Unpatched Vulnerability : CVE-2026-100806

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...

Linux Distros Unpatched Vulnerability : CVE-2026-100816

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Site isolation issue in the DOM: Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157...