CVE-2026-92152

F´: Unvalidated Port Index in GenericHub

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. From 4.1.0 until 4.2.0, Svc::GenericHub output-port dispatch is vulnerable because the deserialized port field is passed to serialOut_out, bufferOut_out, eventOut_out, or tlmOut_out without an explicit range check. When a remote hub packet supplies a port index outside the configured output-port array, assert-enabled builds abort, while builds without assertions can access an output-port array out of bounds, corrupt heap memory, and potentially allow remote code execution. This issue is fixed in version 4.2.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nasa

Products

Fprime

CVE-2026-115377

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Arbitrary File Write via Symlink in Migration Stream

Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an arbitrary file write vulnerability that allows malicious migration sources to write host files by planting symlinks in transferred volumes. Attackers can craft rsync or btrfs receive streams with a symlink such as rootfs pointing to the host root, writing files as root for full host compromise.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Linuxcontainers

Products

Incus

CVE-2026-115324

mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or message names that reach unescaped insert() and update() string interpolation to execute injected SQL on the configured Databricks SQL warehouse.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Mem0ai

Products

Mem0

CVE-2026-93865

Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection

A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the FireCluster management IP when the clustering feature is enabled.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-93857

Fireware OS Pre-Authentication Stack Buffer Overflow in SIP Proxy Allows Remote Code Execution

A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code by sending a specially crafted request through a policy that uses the SIP proxy.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-103593

Fireware OS Stack Buffer Overflow in Logging Service Allows Remote Code Execution

A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Watchguard

Products

Fireware Os

CVE-2026-115384

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 Stack Buffer Overflow

Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows malicious guests to write ~16KB to the native stack via unvalidated async callback result types. Attackers can supply components with mistyped component-model-async callback functions to overwrite return addresses, crashing the host or escaping the sandbox.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Bytecodealliance

Products

Wasmtime

CVE-2022-51026

Bytebase 0.12.0 before 1.0.1 Authentication Bypass via GitLab Self-Hosted Login

Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw stems from trusting client-supplied GitLab provider configuration in the POST /api/auth/login/GITLAB_SELF_HOST endpoint. Attackers can set instanceUrl to a server they control that returns an active user with a chosen email. Bytebase then issues session tokens for that principal, letting attackers impersonate existing users including the Owner or create new members.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Bytebase

Products

Bytebase

CVE-2026-66088

Unrestricted Command Execution via system.execute

In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating system commands without validation or an allow-list of permitted executables. A user able to create or edit scripts can use it to execute arbitrary commands with the privileges of the openEQUELLA service account.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Apereo Foundation

Products

Openequella

CVE-2026-115372

Incus 7.3.0 before 7.5.0 Project Restriction Bypass via block.create_options

Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set block.create_options through volume update, copy, and move operations. Attackers can set the option on a custom volume and trigger a copy or move onto a formatting pool to inject arguments into mkfs executed as root.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Linuxcontainers

Products

Incus

CVE-2021-48016

DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Dedecms

Products

Dedecms

CVE-2026-117564

nest-admin before 1.0.1 Authentication Bypass via Hardcoded JWT Secret

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Buqiyuan

Products

Nest-admin

CVE-2026-114357

DJI CrystalSky ZS600C ships ADB without authentication (ro.adb.secure=0)

Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 allows an attacker to obtain an unauthenticated shell (uid 2000), a foothold for privilege escalation to root. The device ships with ro.adb.secure=0 (no host key authorization) and USB ADB enabled by default; ADB over TCP is not enabled by default but, once enabled (e.g. via the shipped /system/bin/adbd_tcp.sh or 'setprop persist.adb.tcp.port 5555'), the same unauthenticated shell is reachable over the network (CVSS 4.0 base 9.3).

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Dji

Products

Crystalsky Zs600c

CVE-2025-30054

Local Privilege Escalation in CGM CLININET

CGM CLININET is vulnerable to local privilege escalation. The service that processes incoming HL7 messages runs with root privileges, but due to incorrect permissions, its scripts and configuration files can be modified by the uhcapache user. An attacker with uhcapache privileges can modify these files to execute arbitrary code as root. The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet

CVE-2025-30050

Remote Code Execution in CGM CLININET

CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified as a query parameter and executes code from untrusted data provided by the user. An attacker from adjacent network can supply a crafted query parameter to have an attacker-controlled module imported which results in arbitrary code execution with root privileges. This issue was fixed in version 2026.MS3

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet

CVE-2025-30047

Remote Code Execution via Java Deserialization in CGM CLININET

CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted data. The server exposes an HTTP-based API, used by the administrative module, that exchanges data using Java object serialization. An attacker within the same local network is able to send requests to this API and transmit a crafted serialized object. When it is deserialized, it allows arbitrary code execution with root privileges on the server.  This issue was fixed in version 2026.MS3

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet

CVE-2025-30046

Remote Code Execution in CGM CLININET

In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run with root privileges while processing untrusted data received from those external systems. An attacker in adjacent network able to send data to these HL7 communication processes can achieve remote code execution with root privileges.  The vulnerability was confirmed to affect versions up to 2026.MS3 but later versions may also be vulnerable.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Cgm

Products

Cgm Clininet

CVE-2026-114575

TOTOLINK A950RG product.so UploadCustomModule command injection

A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/cste_modules/product.so. Executing a manipulation of the argument FileMd5 can lead to command injection. The attack can be launched remotely. The exploit has been published and may be used.

CVSS 4.0 · 10 Critical EPSS 2.2% KEV · Not listed

Vendors

Totolink

Products

A950rg A950rg Firmware

CVE-2026-114509

Laravel TokenGuard authentication bypass through non-string API credentials

Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not reject a crafted non-string credential. Under affected MySQL or MariaDB configurations, the authentication lookup can match an unintended existing user, allowing an unauthenticated attacker to bypass authentication and take over an account on routes protected by TokenGuard. This issue is fixed in versions 12.68.0 and 13.29.0.

CVSS 4.0 · 9.2 Critical EPSS 1.8% KEV · Not listed

Vendors

Laravel

Products

Framework

CVE-2026-114383

TOTOLINK EX200 wireless.so cstecgi.cgi setWiFiAclAddConfig stack-based overflow

A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi of the component wireless.so. This manipulation of the argument macAddress causes stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Totolink

Products

Ex200 Ex200 Firmware