Arista VeloCloud Orchestrator Improper Input Validation Vulnerability

Arista VeloCloud Orchestrator VCO on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the...

GHSA-JHJP-4C2Q-XMX4 k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

The k8saudit plugin's per-container fields ka.req.pod.containers. and the shipped k8sauditrules.yaml evaluated only requestObject.spec.containers. Security-relevant settings on a pod's initContainers or ephemeralContainers were not inspected, so the shipped Create Privileged Pod rule did not fire...

CVE-2026-61749

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-54584

mport , the MidnightBSD Package Manager, prior to version 2.7.8 , used the TMPDIR environment variable when extracting package metafiles, including in privileged (root, setuid/setgid) contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary ...

CVE-2026-54584 mport trusts environment-controlled temporary directories in privileged metadata extraction

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to a...

CVE-2026-15801

CRI-O contains a vulnerability in its container checkpoint and restore feature where insufficient validation of restore metadata may allow a privileged user to perform unintended operations on the host filesystem . Exploitation requires that checkpoint/restore functionality is explicitly enabled ...

CVE-2026-15801 Cri-o: cri-o: insufficient validation during container checkpoint restore

A vulnerability was found in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

EUVD-2026-83843

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

CVE-2026-90860

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user’s session...

PT-2026-96218

Name of the Vulnerable Software and Affected Versions InvenTree versions prior to 1.4.0 Description Privileged staff users with permissions to author report or label templates can trigger the WeasyPrint report rendering process to retrieve resources selected by an attacker via HTTP, HTTPS, or loc...

PT-2026-96311

Name of the Vulnerable Software and Affected Versions DesktopSMS version 1.11.0 Description An unauthorized access issue exists in the application's local service. Local attackers can interact with this unauthenticated service via same-device loopback to perform privileged SMS operations using th...

PT-2026-96044

Name of the Vulnerable Software and Affected Versions Canva Mobile App for HarmonyOS versions prior to 1.15.1 Description The application fails to restrict headers returned to an external origin operating within a privileged WebView. A privileged WebView is a system component that allows the...

CVE-2026-61749: Exposure of Sensitive Information to an Unauthorized Actor

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

CVE-2026-54584: External Control of File Name or Path

mport is the MidnightBSD Package Manager. mport before 2.7.8 used TMPDIR while extracting package metafiles, including when running as root or in setuid/setgid contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary metadata extraction to a...

PT-2026-96185

Name of the Vulnerable Software and Affected Versions HomeBox versions prior to 0.26.0 Description An authenticated low-privileged user can overwrite or permanently delete maintenance entry records belonging to other tenants. This occurs because the MaintenanceEntryRepository.Update and...

CVE-2026-88856

OrdaSoft Joomla Gallery extension for Joomla versions

CVE-2026-92252

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files x86\Watchdog...

CVE-2026-92252 Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files x86\Watchdog...

CVE-2026-16542 Import and export users and customers < 2.4.5 - Admin+ SSRF via bp_avatar

The Import and export users and customers WordPress plugin before 2.4.5 does not validate a user-supplied URL before requesting it server-side during a CSV import, allowing high-privileged users to perform Server-Side Request Forgery attacks...