Exploited CVEs

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

OpenWrt odhcpd/LuCI: unauthenticated DHCPv6 client can inject lease-file lines via FQDN hostname → stored XSS in the LuCI admin UI

OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

net/sched: act_api: use RCU with deferred freeing for action lifecycle

n8n: Expression Sandbox Escape Leads to RCE

Local MFA not enforced during SSO sign-in

Principal/domain lookup without case normalization

Apache Syncope: Console XXE on Keymaster parameters

Apache Syncope: Reflected XSS on Enduser Login

n8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments

CVE-2026-15342

Unverified email-based SSO account linking

LOIDC nonce validation bypass

IdP-initiated SAML sessions not reliably invalidated (replay)

SAML <Conditions> element not validated

snap-confine Local Privilege Escalation via Capabilities Misconfiguration or Flaw in Execution Environment Setup

xfs: resample the data fork mapping after cycling ILOCK

snapd snap-confine Sandbox Confinement Bypass via Omission of setuid Restriction in Seccomp Templates

The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an attacker, they can be exploited in ways that may be surprising. In Apache Tomcat 9.0.0.M1 to 9.0.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99, Tomcat shipped with an AJP Connector enabled by default that listened on all configured IP addresses. It

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. The go pprof endpoint is exposed over the Kubelet's healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8, and 1.12.10 are affected. The issue is of medium severity, but not exposed by the default configuration.

Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along wit

ingress-nginx controller - configuration injection via unsanitized auth-url annotation

ingress-nginx admission controller RCE escalation

ingress-nginx controller - auth secret file path traversal vulnerability

ingress-nginx controller - configuration injection via unsanitized auth-tls-match-cn annotation

ingress-nginx controller - configuration injection via unsanitized mirror annotations

net: skbuff: propagate shared-frag marker through frag-transfer helpers

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When

crypto: algif_aead - Revert to operating out-of-place