CVE Vulnerability Catalog

Missing authorization in imageDownload in Canonical LXD before versions 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to access private images from other projects via local fingerprint reuse during image or instance import requests.

Path traversal in the CLI client image export and copy functionality in Canonical LXD from 4.0.2 before 4.0.14, 5.0.10, 5.21.8, and 6.10 on all platforms allows a remote malicious or machine-in-the-middle image server to overwrite arbitrary local files and execute code on the client system via a crafted Content-Disposition header filename parameter during unified image export or copy operations into a local directory target.

Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version V4.

Path Traversal vulnerability in ABB Protection and control IED manager (PCM600) through version 2.14. Allows an attacker to access files outside the intended directory.

Incorrect Permission Assignment for Critical Resource vulnerability in ABB Protection and control IED manager (PCM600) through version 2.14. May allow an attacker to gain unauthorized access to resources.

A vulnerability was determined in Acrel Electric Unet Web Service up to 20260814, affecting unknown code of the file /exchange/attachment/upload in the Upload Endpoint component. Manipulation of the File argument causes unrestricted upload. The attack can be initiated remotely and the exploit has been publicly disclosed.

A security vulnerability has been detected in dbgate up to 7.3.1, affecting the function files in packages/api/src/controllers/runners.js of the Files Endpoint component. Manipulation of the runid argument leads to path traversal. The attack is possible remotely and the exploit has been publicly disclosed.

mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies, allowing an authenticated LAN attacker to send large request bodies that exhaust RAM buffers, causing out-of-memory conditions and crashing the fh-node process. Due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any LAN user can perform this attack.

mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service.

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions.

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service.

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated LAN attacker can query these endpoints, access system information, and send raw control commands to manipulate building automation devices.

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform through 2026-09-28.

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities, including forcing the router to issue GET requests to arbitrarily chosen domains.

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross-domain authenticated request. This can lead to unauthorized access to protected resources in the context of a logged-in user.

A weakness has been identified in dbgate up to 7.3.1 in the exportModelSql function of packages/api/src/controllers/databaseConnections.js (Export Handler component). Manipulating the outputFile argument leads to path traversal, and the attack can be executed remotely. The exploit has been made publicly available and could be used for attacks.

A security flaw has been discovered in dbgate up to 7.3.1 in the zipJsonLinesData function of packages/api/src/utility/zipJsonLinesData.js (Create Connection Endpoint component). Manipulating the filePath argument results in path traversal, and remote exploitation is possible. The exploit has been released to the public and may be used for attacks.

A security flaw has been discovered in Thinkware U3000 up to 1.02.04 in the GET_STATUS function of the TCP Service component. Manipulating the wifi_info argument results in information disclosure, and the attack can be executed remotely. The exploit has been released to the public and may be used for attacks.