Canonical EUVD-2026-20872

An authenticated path traversal vulnerability in Langflow's file upload functionality allows attackers to write arbitrar

An authorization bypass vulnerability in gRPC-Go allows attackers to circumvent path-based access control by sending HTT

Resource exhaustion in OpenTelemetry Go propagation library (v1.41.0 and earlier) enables remote attackers to trigger se

Path traversal in ApostropheCMS import-export module allows authenticated users with content modification permissions to

The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such a

Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a p

{$exists:true}`) that override the builder's intended filter, returning or altering every document in a MongoDB, CouchDB

Cross-guest storage-volume hijacking in Canonical LXD 6.6 through 6.8 lets an untrusted guest instance mount, read, and

efw4.X is an Enterprise Framework for Web. Prior to 4.08.010, efw.file.FileManager.unZip writes zip entries to disk usin

Consensus failure in Zebra nodes before 4.3.1 allows remote attackers to trigger network partitioning by submitting V4 o

Privilege escalation in Canonical LXD 4.12 through 6.7 enables remote authenticated restricted TLS certificate users to

Critical privilege escalation vulnerability in FreeIPA that allows authenticated users with high privileges to create Ke