8 matches found
EUVD-2026-58499
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...
CVE-2026-72842
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...
CVE-2026-72842 OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...
CVE-2026-72842 OpenWrt luci-app-lxc ACL Inconsistency Authentication Bypass
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxcname parameter to escape container directories a...
CVE-2026-72842
The CVE-2026-72842 entry concerns luci-app-lxc on OpenWrt. It describes an ACL inconsistency that lets low-privileged, authenticated LuCI users access backend container management routes without proper authorization checks. A path traversal via /.%2E in the lxc_name parameter can escape container...
PT-2026-71905
luci-app-lxc contains an ACL inconsistency vulnerability that allows low-privileged authenticated LuCI users to access backend container management routes without proper authorization checks. Attackers can exploit path traversal via /.%2E in the lxc name parameter to escape container directories...
EUVD-2026-56914
An issue in MongoDB Server's applyOps command could allow an authenticated user with specific non-default privileges to perform certain data-definition operations, such as dropping or modifying collections, against collections they do not have permission to manipulate. This is due to an...