Incorrect authorization in LXD storage volume API allows reading volumes from other projects
CVE-2026-97335
Incorrect authorization in the custom storage volume creation endpoint in Canonical LXD versions 5.0.0 and later (fixed
2026-09-29 归档
今日共收录 1279 条安全情报，包含 376 个 CVE，505 篇安全通告，以及 100 篇研究论文。
← 返回归档列表Path traversal in LXD btrfs storage driver allows arbitrary file deletion and write on host as root
CVE-2026-85185
Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 an
Path traversal via Btrfs optimized-backup subvolumes[].path enables root file/dir manipulation in LXD
CVE-2026-85526
Path traversal in the Btrfs storage driver (unpackVolume) in Canonical LXD on Linux allows an authenticated user with in
LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse
CVE-2026-86335
Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restri
CLI Path Traversal via Content-Disposition in LXD Image Export/Copy
CVE-2026-86334
Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10,
OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
CVE-2026-78424
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write)
Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes
CVE-2026-19444
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When cop
aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception
CVE-2026-101035
A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library sr
Denial of service via unsigned underflow in libXpm's write path
CVE-2026-94287
A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attacke
Apache Roller: Stored XSS in comment moderation via comment author URL
CVE-2026-86507
Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-a
Trusted Domain Project OpenDMARC DMARC Record opendmarc_util.c opendmarc_util_cleanup off-by-one
CVE-2026-101014
A vulnerability was detected in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this vulnerability is the func
Apache Roller: WSSE digest authentication headers can be replayed
CVE-2026-82379
Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authe
Apache Roller: CSRF protection bypass via self-generated salt validation
CVE-2026-82380
Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform s
Apache Roller: Reflected cross-site scripting in the frontpage directory parameter
CVE-2026-82382
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a rem
Apache Roller: Anonymous setup action allows frontpage configuration tampering
CVE-2026-82383
Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persist
Apache Roller: Unauthenticated deserialization in the XML-RPC endpoint
CVE-2026-82384
Deserialization of Untrusted Data in Apache Roller 6.1.5 allows an unauthenticated remote attacker to cause deserializat
Apache Roller: Server-side request forgery via entry trackback and enclosure URLs
CVE-2026-82375
Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a we
Apache Roller: XML external entity processing in trackback response parser
CVE-2026-82376
Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a user with entry-editing rights on
Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers
CVE-2026-82377
Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belo
Apache Roller: Weblog template include escapes the Velocity sandbox and reads classpath files
CVE-2026-82385
Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read