firefox: thunderbird: Mitigation bypass in the Storage: Cache API component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Storage: Cache API component...

firefox: thunderbird: Mitigation bypass in the Storage: Cache API component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Storage: Cache API component...

CVE-2026-78251 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

CVE-2026-78251 DJI Drone FTP Service Allows Unrestricted Storage Consumption of the /blackbox Directory

DJI drones contain an FTP service that uses hardcoded credentials shared across affected models and permits authenticated users to upload files without limits on file size, file count, or total storage consumed in /blackbox/upgrade/, as well as overwrite existing files in that directory. An...

CVE-2026-78251

DJI drones (15 models including Mavic 4 Pro, Air 3S, Mini 5 Pro, and others) expose an FTP service with hardcoded credentials shared across affected firmware versions. An attacker with access to the drone's internal network or USB RNDIS interface can upload unlimited files to /blackbox/upgrade/, ...

PT-2026-80919

Relative path traversal vulnerability in Apache Camel Google Storage component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-google-storage consumer downloads Google Cloud Storage objects to the local filesystem when th...

PT-2026-80916

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.8 Apache Camel versions 4.15.0 through 4.18.3 Apache Camel versions 4.19.0 through 4.21.x Description A relative path traversal issue exists in the camel-azure-storage-datalake component during the...

PT-2026-80918

Relative path traversal vulnerability in Apache Camel Azure Storage Blob component. This issue affects Apache Camel: from 4.0.0 before 4.14.9, from 4.15.0 before 4.18.4, from 4.19.0 before 4.22.0. The camel-azure-storage-blob component can download an Azure Storage blob to the local filesystem...

PT-2026-79833

Name of the Vulnerable Software and Affected Versions DJI Neo versions prior to 01.00.0400 DJI Neo 2 versions prior to 01.00.0500 DJI Flip versions prior to 01.00.1200 DJI Air 3 versions prior to 01.00.1600 DJI Air 3S versions prior to 01.00.1400 DJI Avata 2 versions prior to 01.00.0400 DJI Avata...

CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...

CVE-2026-54457

TensorZero (open-source LLMOps platform) is vulnerable to arbitrary file read and SSRF via its Gateway /internal/object_storage endpoint in versions prior to 2026.6.0 . The endpoint accepts a caller-supplied JSON storage_path parameter that dynamically overrides the [object_storage] configuration...

CVE-2026-54457 TensorZero: Arbitrary file read and SSRF in TensorZero Gateway's internal object storage endpoint

TensorZero is an open-source LLMOps platform that unifies an LLM gateway, observability, evaluation, optimization, and experimentation. Prior to 2026.6.0, the TensorZero Gateway /internal/objectstorage endpoint accepts a caller-supplied JSON storagepath parameter that dynamically overrides the...

CVE-2026-27875

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

CVE-2026-27875

Johnson Controls Simplex Incident Manager / Autocall Fire Administrator (before 2.01.05 ) stores user credentials—passwords and authentication tokens—in unencrypted form within system memory while running. A local attacker with low privileges can extract these embedded sensitive data using memory...

CVE-2026-27875 Simplex Incident Manager Clear Test

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

EUVD-2026-64036

Cleartext Storage of Sensitive Information in Memory vulnerability in Johnson Controls Simplex Incident Manager / Autocall Fire Administrator may allow an attcker to Retrieve Embedded Sensitive Data. This issue affects Simplex Incident Manager / Autocall Fire Administrator: before 2.01.05...

CVE-2026-62867

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...

EUVD-2026-63987

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...

CVE-2026-62867

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...

CVE-2026-62867 Incus has an argument injection in storage volume block.create_options that leads to arbitrary command execution

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...