Vulnerabilities

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CAPTCHA Protected Page allows Functionality Bypass. This issue affects CAPTCHA Protected Page versions: from 0.0.0 to 1.0.2.

Improper Handling of Case Sensitivity vulnerability in Drupal External Authentication allows Privilege Escalation. This issue affects External Authentication versions: from 0.0.0 to 2.0.13.

CVE-2026-66897 is a path traversal flaw (CWE-22/CWE-23) in LXD's instance template processing: when handling target template paths declared in an image's metadata.yaml, LXD validates the path against a confined os.Root directory handle but then opens and creates the file with os.Create using an unconfined string path, so the check and the actual file creation can disagree. It is triggered by an authenticated user with permission to edit a container/instance, or by any user who launches an instance from a crafted image containing a malicious template path that escapes directory confinement. Successful exploitation lets the attacker overwrite arbitrary root-owned files on the LXD host and achieve host root code execution, consistent with the critical 9.9 CVSS score (network vector, low privileges, changed scope). The flaw affects Canonical LXD deployments, and it is most consequential on hosts where untrusted users hold container-edit rights or can import and launch images. Exploitation status: not listed in CISA KEV, EPSS estimates a ~0.6% probability of exploitation within 30 days (48th percentile), and one public advisory/PoC reference exists, so there is no confirmed in-the-wild exploitation at this time.

Do: Upgrade LXD to a patched release identified in Canonical's security advisory (GHSA-q39m-8fx9-42fv); the supplied data does not include fixed version numbers. Until patched, restrict container-edit permissions and image import/launch rights to trusted users and limit network exposure of the LXD API. Review hosts for untrusted users with instance-edit rights or use of third-party images, and verify the integrity of critical root-owned files.

Canonical LXD contains a link-following vulnerability (CWE-59) in its handling of the backup.yaml file during the import or unpacking of image and backup archives: when backup.yaml inside a submitted archive is a symbolic link, LXD follows it without proper confinement and processes unconfined configuration metadata. An attacker who can import a crafted archive — for example an authenticated LXD user or a tenant permitted to load images — can thereby have arbitrary commands executed with root privileges on the host system, breaking container-to-host isolation (CVSS 3.1: 9.9, scope changed). Any LXD deployment that accepts image or backup imports from less-than-fully-trusted users, particularly multi-tenant installations, is affected. Exploitation has not been confirmed in the wild (not listed in CISA KEV; EPSS ~1% over 30 days), but a public proof-of-concept/advisory is available via Canonical's GitHub security advisory GHSA-fv82-v4fj-mm4m.

Do: Upgrade LXD to the patched release identified in Canonical's security advisory (GHSA-fv82-v4fj-mm4m) and confirm the running version after updating. Until patched, restrict image/backup import permissions to fully trusted administrators and inspect incoming archives, rejecting any where backup.yaml is a symbolic link. Prioritize multi-tenant or internet-reachable LXD instances, where compromise of a low-privileged user yields full root on the host.

ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Successful exploitation results in code execution in the context of the ScadaLTS server process (root), leading to full compromise of the underlying system.

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds, leaving the 64-bit Simple8b index unvalidated and the read offset attacker-controlled. Attackers with DML access to a physical compressed relation can store a crafted datum and run a reverse-order scan. With a pass-by-value column type the out-of-bounds Datum is returned to the client as a normal column value, disclosing backend memory including the shared buffer pool, which SQL access control does not cover.

In Bouncy Castle for Java before 1.85, Name Constraints bypass via trailing dot in rfc822Name and URI. This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).