CVE-2026-124415

WordPress Alex Reservations plugin <= 2.4.8 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Alejandro Alex Reservations alex-reservations allows SQL Injection.This issue affects Alex Reservations: from n/a through 2.4.8.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Alejandro Wordpress-extensions

Products

Alex Reservations Alex Reservations

CVE-2026-125432

WordPress reCAPTCHA for WooCommerce plugin <= 1.4.7 - Broken Authentication vulnerability

Weak Password Recovery Mechanism for Forgotten Password vulnerability in RelyWP reCAPTCHA for WooCommerce recaptcha-woo allows Password Recovery Exploitation.This issue affects reCAPTCHA for WooCommerce: from n/a through 1.4.7.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Relywp Wordpress-extensions

Products

Recaptcha For Woocommerce Recaptcha For Woocommerce

CVE-2026-63079

RBH Integra32 5.1.11 .NET Remoting Deserialization RCE

RBH Access Technologies Integra32 Security Management System 5.1.11 R5.0 contains an unauthenticated deserialization vulnerability in its deprecated .NET Remoting service, exposed on TCP port 2001 via the AxcvcLt.dll library using BinaryServerFormatterSinkProvider at TypeFilterLevel.Full without requiring authentication. A remote unauthenticated attacker can send a malicious serialized gadget payload (such as a ysoserial.net TypeConfuseDelegate chain) to the IntegraURI object endpoint, or exploit MarshalByRefObject/MarshalByValue unmarshalling for arbitrary file read/write and SMB/NTLMv2 credential coercion, to achieve remote code execution as NT AUTHORITY\SYSTEM and fully compromise the host.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Rbh Access Technologies

Products

Integra32 Security Management System

CVE-2026-105671

Zenitel Connect login allows username enumeration via verbose error responses

The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-129105

Cudy TR3000 before 2.5.42 pppd Option Injection via net.set_wan L2TP Credentials

Cudy TR3000 before 2.5.42 contains an option injection vulnerability that allows authenticated administrators to inject arbitrary pppd options by embedding quotes and newlines in L2TP credentials. Attackers can submit crafted usernames or passwords to the net.set_wan RPC method, which l2tp.sh writes into a pppd options file, adding options like logfile to the root pppd process.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129104

Cudy TR3000 before 2.5.42 dnsmasq Configuration Injection via net.set_dhcp

Cudy TR3000 before 2.5.42 contains a dnsmasq configuration injection vulnerability that allows authenticated administrators to inject directives by embedding a newline in the net.set_dhcp leasetime field. Attackers can append address= entries via /etc/init.d/dnsmasq to alter DNS answers for LAN clients, or insert invalid lines that stop dnsmasq.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129103

Cudy TR3000 before 2.5.42 Command Injection via Scheduled Reboot Time

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.

CVSS 4.0 · 8.6 High EPSS 2.0% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129102

Cudy TR3000 before 2.5.42 Command Injection via vpn.set_conf IPsec keyexchange

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into the IPsec keyexchange field of the vpn.set_conf RPC method. Attackers can append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin runs as root when an attacker-controlled peer establishes the CHILD_SA.

CVSS 4.0 · 8.6 High EPSS 1.7% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129101

Cudy TR3000 before 2.5.42 Authenticated RCE via vpn.set_conf Mass Assignment

Cudy TR3000 before 2.5.42 contains a mass assignment vulnerability in the vpn.set_conf App RPC method that allows authenticated administrators to inject arbitrary OpenVPN server options. Attackers can set enabled=1 and a malicious up option in the openvpns object, which the openvpn-hotplug wrapper executes via /bin/sh as root.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129100

Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Key Upload Injection

Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading crafted OpenVPN private or tls-auth keys. Attackers can close the inline key block with </key>, inject directives such as tls-verify that bypass the .ovpn denylist, and have OpenVPN execute the hook as root.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-129099

Cudy TR3000 before 2.5.42 Root RCE via OpenVPN Configuration Import

Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Shenzhen Cudy Technology

Products

Tr3000

CVE-2026-105625

Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction

The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-105622

Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel

Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-105624

Zenitel Connect login allows account-lockout denial of service

The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-105623

Zenitel Connect web interface serves production JavaScript source maps without authentication

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-95379

Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root

Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter. This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Vsff6 Vsff8 Vsff8mn and 2 more

CVE-2026-95613

Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-95378

Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root

Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped. This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Vsff6 Vsff8 Vsff8mn and 2 more

CVE-2026-95615

Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect

CVE-2026-95614

Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Zenitel

Products

Zenitel Connect