An HTTP header injection vulnerability was found in the ADM start-page-loader.cgi, allowing an unauthenticated remote attacker to read arbitrary files on the host system by sending a crafted HTTP request with injected headers via the state parameter. This vulnerability affects ADM versions from 4.1.0 through 4.3.3.RWC1 and from 5.0.0 through 5.1.4.RL21. The CVE Program record and NVD vulnerability detail [truncated]
The CVE-2026-18759 vulnerability affects the background service of ABP (ASUSTOR Backup Plan) and AES (ASUSTOR EZSync), which run as NT AUTHORITY SYSTEM. These services implement a file-based inter-process communication (IPC) mechanism protected by AES encryption. However, the encryption key file is readable by standard users and protected using DPAPI, allowing authenticated local users to recover the key [truncated]
