CVE-2026-109445

PLANET GS-5220-8P2T2S Stack Buffer Overflow via webstax_auth Cookie

PLANET GS-5220-8P2T2S (hardware version 3.0) firmware versions before 3.2412b261008 contains a stack-based buffer overflow vulnerability that allows unauthenticated attackers to corrupt stack memory by submitting an oversized webstax_auth HTTP Cookie value that is copied into a fixed-size stack buffer without length validation. Attackers can send a crafted unauthenticated HTTP request with an oversized cookie to overwrite the saved return address and corrupt stack memory, leading to memory corruption and potential denial of service on the device.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124002

Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.3 Critical EPSS 4.9% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-124012

Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-124010

Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.3 Critical EPSS 3.1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-124007

Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS 2.1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-124006

Dixell/Copeland XWEB EVO Predictable Root Password Generation

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-124005

Dixell/Copeland XWEB EVO Predictable Administrator Password Generation

XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-124004

Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password

XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-126539

Directus before 12.1.0 Authorization Bypass via Public WebSocket REST Interface

Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip permission checks by sending a failed auth message on public-mode WebSocket connections. Attackers can send an invalid token so handleAuthRequest sets accountability to null, then read, create, update or delete records in any user-defined collection.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Directus Monospace

Products

Directus Directus

CVE-2026-125883

Multiple XXE Vulnerabilities

Improper restriction of XML external entity reference vulnerability in N-able N-central allows XML Schema Poisoning. This issue affects N-central: before 26.4.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

N-able

Products

N-central

CVE-2026-125881

Schema-hint SSRF via service import schema validation

Server-Side request forgery (SSRF) vulnerability in N-able N-central allows Server Side Request Forgery. This issue affects N-central: before 26.4.1.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

N-able

Products

N-central

CVE-2026-120869

An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance

An unauthenticated attacker can bypass authentication controls to access restricted resources on the Citrix NetScaler Console appliance

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75491

Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens

Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75495

Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution.

CVSS 4.0 · 9.2 Critical EPSS 2.6% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126269

NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type

NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126273

NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap

NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126274

NocoDB before 2026.08.0 Stored XSS via Table Deletion Dialog

NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to inject script by embedding markup in column or table titles. The Delete.vue confirmation dialog renders these titles through an unescaped innerHTML binding, executing script when a victim deletes an external-source table to steal session tokens from localStorage.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126280

NocoDB before 2026.08.0 Refresh Token Reuse via Non-Atomic Rotation

NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens because UserRefreshToken.ts never checks the affected-row count. Attackers holding a captured refresh token can present it concurrently with the legitimate user to obtain a valid authenticated session, and no reuse event is recorded.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126380

Vvveb before 1.0.9.0 RCE via .phar Extension Denylist Bypass in Media Upload

Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a leading dot, allowing authenticated administrators to upload .phar PHP files. Attackers can upload a GIF magic-byte polyglot webshell bypassing binary inspection and execute arbitrary OS commands as the web-server user.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Vvveb

Products

Vvveb

CVE-2026-126953

Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Username

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues request with shell metacharacters that set_UserUsername() in obuspa_system.lua passes to os.execute(), gaining root command execution.

CVSS 4.0 · 9.2 Critical EPSS 2.6% KEV · Not listed

Vendors

—

Products

—