CVE Vulnerability Catalog

A vulnerability was identified in Tencent AI-Infra-Guard up to 4.5.2/4.6.2. The startsWith function in skill_scan/tools/dir/dir_actions.py of the File Access component leads to path traversal. The attack needs to be performed locally. The exploit is publicly available. Upgrading to version 4.6.0 mitigates this issue.

A vulnerability has been found in deepseek-ai deepseek-harness up to 0.1.7-rc.2. An unknown function in packages/sandbox/sandbox-local/src/profiles.ts of the Landlock Backend component leads to improper isolation or compartmentalization. The attack must be carried out locally. The exploit has been disclosed to the public. The vendor did not respond.

A privilege mismatch was found in Fleet. When a bundle requested namespace labels or annotations through the namespaceLabels and namespaceAnnotations options, the resulting namespace metadata update was not subject to the same authorization as the rest of the bundle's deployment. As a result, a bundle could change labels and annotations on a target namespace even when the identity it was pinned to was not authorized to modify that namespace.

A vulnerability was discovered in Fleet's Git webhook receiver (the gitjob webhook service). When a webhook secret is not configured, incoming webhook requests are accepted without verification, and processing a request can change the spec.pollingInterval field of a matching GitRepo resource in any namespace. A caller with network access to the webhook service and no Kubernetes credentials can therefore alter GitRepo configuration outside the namespaces they are authorized for.

Dell Boot Optimized Server Storage (BOSS) prior to version 2.2.13.2038 contains an improper access control vulnerability in the on-chip debug and test interface in SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could exploit this, leading to unauthorized access.

Dell Boot Optimized Server Storage (BOSS) prior to version 2.2.13.2038 contains an improper access control vulnerability in the on-chip debug and test interface in SMCU on 17G BOSS-N1 controllers. An unauthenticated attacker with physical access could exploit this, leading to unauthorized access.

Dell Live Optics Collector prior to version 27.2.13.310 contains a hard-coded password vulnerability. A low-privileged attacker with local access could exploit this, leading to information exposure.

A user who can supply bundle content to a repository referenced by a GitRepo resource, for example through Git push access or permission to create/modify a GitRepo, can cause SUSE Rancher Fleet to read files from the filesystem of the environment processing the bundle and include their contents in the generated Bundle resource. This can expose configuration or credential material the user has no Kubernetes RBAC permission to read, including Helm registry credentials made available to the bundle-processing job when per-path Helm credentials are configured.

Improper link resolution in the recursive file pull feature of the LXD CLI client in versions 4.0.2 up to 6.9 (fixed in 4.0.14, 5.0.10, and 5.21.8) on Linux allows an attacker with root access inside a virtual machine to write attacker-controlled files or directory trees to arbitrary paths on the client host, with the operator's privileges. The attacker does this by using a modified lxd-agent that returns inconsistent SFTP directory listings and Lstat results.

Missing authorization in imageDownload in Canonical LXD before versions 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4.

Path Traversal vulnerability in ABB Protection and control IED manager (PCM600) through version 2.14. Allows an attacker to access files outside the intended directory.

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600) through version 2.14. May allow an attacker to gain unauthorized access to resources.

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814, affecting unknown code of the file /exchange/attachment/upload in the Upload Endpoint component. Manipulation of the File argument causes unrestricted upload. The attack can be initiated remotely and the exploit has been publicly disclosed.

A security vulnerability has been detected in dbgate up to 7.3.1, affecting the function files in packages/api/src/controllers/runners.js of the Files Endpoint component. Manipulation of the runid argument leads to path traversal. The attack is possible remotely and the exploit has been publicly disclosed.

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies, allowing an authenticated LAN attacker to send large request bodies that exhaust RAM buffers, causing out-of-memory conditions and crashing the fh-node process. Due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any LAN user can perform this attack.

mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service.

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions.

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service.