Improper certificate validation in the LXD HTTPS listener lets a remote unauthenticated attacker present a crafted certificate chain to authenticate as any trusted client, gaining full access to the cluster and managed VMs. Affects lxd `4.0.14-

SQL injection in Django raster lookups on RasterField (PostGIS-only) lets remote attackers inject SQL via the band index parameter in raster queries. Affects Django 6.0 < 6.0.2, 5.2 < 5.2.11, 4.2 < 4.2.28 (unsupported 5.0.x/4.1.x/3.2.x may also be affected).The vulnerability was disclosed and fixed in February 2026, and has been actively exploited now. Upgrade to 6.0.2, 5.2.11, or 4.2.28 to mitigate.

Jpom auth bypass lets remote unauthenticated attackers gain super-admin by injecting query conditions into the JPOM-USER-TOKEN header (e.g., is not null) that Hutool’s Condition parser treats as an operator. Affects dromara Jpom 2.10.0 through 2.11.12 (pkg:maven/org.dromara.jpom/server). Attackers can execute commands via Jpom script features.

pgAdmin 4 Import/Export Data wraps query exports in psql copy (…) TO and checks balanced parentheses, but mishandles backslashes in double-quoted identifiers when standard_conforming_strings is off. An authenticated user with Import/Export Data permission can break out of copy and execute TO PROGRAM on the pgAdmin host as the pgAdmin OS account. Affected: < 9.19; upgrade to 9.19+ to mitigate.

Actively exploited missing authorization in Drupal Commerce Core lets unauthenticated attackers force-browse insufficiently protected routes and entity fields. Affects 0.0.0 to 2.41 and 3.0.0 to 3.3.13. The access bypass can expose/alter commerce data and cause financial impact. Remediate by upgrading to 8.x-2.41 or 3.3.13 (per branch).

ClickHouse Server has an integer overflow/wraparound in request parsing/validation that can be triggered remotely to corrupt bounds and reach a command injection sink, resulting in unauthenticated remote code execution under the clickhouse-server user. Not exploitable if the vulnerable endpoint is not exposed to untrusted networks.

Affects ClickHouse 26.3 < 26.3.62.3-lts, 26.8 < 26.8.36.3-lts, 26.9 < 26.9.27.3-stable, 26.10 < 26.10.3.7-stable; Upgrade to 26.3.62.3-lts / 26.8.36.3-lts / 26.9.27.3-stable / 26.10.3.7-stable (or later) to mitigate