Botslab G980H Dashcams

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication controls, gain unauthorized access to sensitive data and privileged device functionality, modify device configuration, disrupt device operation. 2. RECOMMENDED PRACTICES CISA...

CVE-2026-97176

A logic error in the Level of Authentication enforcement mechanism of Keycloak , an identity and access management solution, allows users to bypass security requirements. When a client requests a higher security level for a user with an active session at a lower level, Keycloak may incorrectly is...

CVE-2026-97176 Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...

EUVD-2026-85792

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...

CVE-2026-97176

A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an active session at a lower level. Due to a logic error in how...

freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes

A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied...

buildkit: github.com/moby/buildkit: BuildKit: File escape vulnerability

A flaw was found in BuildKit. A custom client with valid permissions to access the BuildKit control API can produce an upload request that allows files to escape from the BuildKit-controlled state directory. This could lead to unauthorized modification or disclosure of sensitive data...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

DEBIAN-CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only covers the method, expiry, and path, and thus the list of disallowed headers is the only defense against a signed PUT request changing what the request does. A...

CVE-2026-97149

In OpenStack Swift versions before 2.38.2 , a vulnerability exists because the tempurl middleware fails to reject the X-Copy-From header on PUT requests. Since the TempURL signature only validates the method, expiry, and path, an attacker with a valid PUT TempURL for a single object can include a...

CVE-2026-97056

SigNoz versions from v0.98.0 up to but not including v0.143.0, when configured to use the opaque session tokenizer which was not the default before v0.143.0, do not revoke a user's existing login sessions when the user's password is reset with a reset token UpdatePasswordByResetPasswordToken,...

PT-2026-98277

Name of the Vulnerable Software and Affected Versions Botslab G980H affected versions not specified Description The firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value...

PT-2026-97785

Name of the Vulnerable Software and Affected Versions MailerLite – Signup forms official plugin for WordPress versions prior to 1.7.22 Description An issue exists where a missing capability check in the forms method of the AdminController class allows authenticated users with Contributor-level...

PT-2026-98160

Name of the Vulnerable Software and Affected Versions Discourse versions prior to 2026.1.8 Discourse versions prior to 2026.6.3 Discourse versions prior to 2026.7.2 Discourse versions prior to 2026.8.0 Description The iframe src traversal guard fails to treat literal backslashes as path separator...

PT-2026-97783

Name of the Vulnerable Software and Affected Versions Qt VNC Server affected versions not specified Description An authentication bypass exists in the password authentication mechanism of the Qt VNC Server module. An attacker can use a modified VNC client that violates the RFB Remote Frame Buffer...

PT-2026-97788

Name of the Vulnerable Software and Affected Versions Liman MYS versions 2.3.2 through 2.3.4-1123 Description An improper limitation of a pathname to a restricted directory, known as Path Traversal, allows unauthorized access to files or directories outside the intended folder. Recommendations...

CVE-2026-93353: Improper Link Resolution Before File Access

copyparty contains a volume restriction bypass vulnerability in its SFTP front end that allows authenticated SFTP users to create, remove, and truncate arbitrary paths outside permitted volume boundaries by exploiting three handlers that bypass the xvol volflag enforcement. The mkdir, rmdir, and...

LibreNMS SNMP Unauthorized Access Cross-site

The vulnerability of the SNMP protocol implementation in the LibreNMS network monitoring system is related to deficiencies in the process of blocking outdated PHP templates. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information and perform...

ImageIO Component Privilege Escalation

The vulnerability of the ImageIO component in the Oracle Java SE software platform, as well as in Oracle GraalVM for JDK and Oracle GraalVM Enterprise Edition virtual machines, is related to access control errors. Exploiting this vulnerability can allow an attacker to gain unauthorized access to...