Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 24,503

Export CSV
CVE-2026-75487

Cudy TR3000 before 2.5.42 Command Injection via WireGuard private_key Export

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-75495

Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-75576

Cudy TR3000 before 2.5.42 Command Injection via VPN Configuration Upload Filename

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration file through the VPN client config page with a filename containing $() shell substitution, which is passed through Lua %q to /bin/sh -c.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-75577

Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-75578

Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload

Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126953

Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Username

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying an unvalidated InternetGatewayDevice.User.{i}.Username value. Attackers can send a SetParameterValues request with shell metacharacters that set_UserUsername() in obuspa_system.lua passes to os.execute(), gaining root command execution.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-128014

FrankenPHP 1.8.0 before 1.13.2 Out-of-Bounds Write via Bundled Brotli Decoder

FrankenPHP standalone static binaries 1.8.0 before 1.13.2 bundle the PHP brotli extension statically linked with Brotli 1.2.0, whose decoder contains an out-of-bounds write (CVE-2026-111497). Unauthenticated remote attackers can send crafted data to applications that pass it to brotli_uncompress_add() to crash the entire FrankenPHP process, and possibly cause memory disclosure or code execution.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
Php
Products
Frankenphp
CVE-2026-124002

Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Username

XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-124007

Dixell/Copeland XWEB EVO Pre-Auth OS Command Injection via Password Field

XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-124008

Dixell/Copeland XWEB EVO OS Command Injection via devices.lua

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-124009

Dixell/Copeland XWEB EVO OS Command Injection via backup.lua

XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-124010

Dixell/Copeland XWEB EVO Unauthenticated Command Injection via xwconsole.cgi

XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.3 Critical EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-124013

Dixell/Copeland XWEB EVO OS Command Injection via api.lua

XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 8.7 High EPSS n/a KEV · Not listed
Vendors
Copeland
Products
Xweb Evo
CVE-2026-75785

Improper OS Command Injection in Synology VPN API

An improper neutralization of special elements used in an OS command vulnerability in the VPN API in Synology DiskStation Manager (DSM) before 7.3.2-86009-5 and 7.4.1-90080-1 allows remote authenticated users with administrator privileges to read or write arbitrary files and conduct denial-of-service attacks.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Synology
Products
Diskstation Manager
CVE-2026-127030

Freeradius: stack buffer overflow via unchecked eap-fast sessionticket length

A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).

CVSS 3.1 · 7.5 High EPSS n/a KEV · Not listed
Vendors
Freeradius Red Hat Redhat
Products
Freeradius Enterprise Linux Enterprise Linux and 1 more
CVE-2026-126231

OS Command Injection in Fortinet FortiAnalyzer and FortiManager

A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiAnalyzer 8.0.0, FortiAnalyzer 7.6.0 through 7.6.7, FortiAnalyzer 7.4.0 through 7.4.11, FortiAnalyzer 7.2 all versions, FortiAnalyzer Cloud 7.6.0 through 7.6.7, FortiAnalyzer Cloud 7.4.1 through 7.4.11, FortiAnalyzer Cloud 7.2 all versions, FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.11, FortiManager 7.2 all versions, FortiManager Cloud 7.6.0 through 7.6.7, FortiManager Cloud 7.4.1 through 7.4.11, FortiManager Cloud 7.2 all versions may allow an authenticated attacker to execute unauthorized commands via a crafted HTTP request.

CVSS 3.1 · 7.2 High EPSS 1.6% KEV · Not listed
Vendors
Fortinet
Products
Fortianalyzer Fortianalyzer Cloud Fortianalyzercloud and 3 more
CVE-2026-52786

BACnet Stack: malicious ReadPropertyMultiple-ACK with excessive properties causes global-buffer-overflow in ProcessRPMData()

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, in the official apps/epics client tool on v1.6.0-rc1 (not in the generic BACnet RPM ACK decoder alone) a malicious BACnet/IP endpoint can reply to the EPICS tool’s legitimate ReadPropertyMultiple request with a syntactically valid ReadPropertyMultiple-ACK that contains more heading properties than the tool’s fixed local storage can hold. The response is decoded successfully and later consumed by ProcessRPMData(), which writes property values into a fixed global array using an unbounded linear index. This results in a reproducible global-buffer-overflow in apps/epics/main.c. This is a network-reachable memory corruption in the official epics tool’s response-processing path. The root cause is that apps/epics treats a remotely supplied variable-length RPM property list as if it were a trusted, fixed-size local heading-property set. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.

CVSS 3.1 · 7.1 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-47259

BACnet Stack: Stack-based buffer overflow in Notification Class RemoveListElement recipient-list decoding

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a RemoveListElement request targeting Notification-Class.recipient-list can trigger a stack-based out-of-bounds write in the current master branch when the request contains more than NC_MAX_RECIPIENTS valid BACnetDestination elements. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.

CVSS 3.1 · 8.2 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-47711

BACnet Stack: Stack buffer overflow in Loop internal ReadProperty path via Life_Safety_Zone.accepted-modes on the default BACnet/IP server

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, the current master demo server can be crashed remotely over BACnet/IP by sending a valid Confirmed WriteProperty request that updates loop-1's controlled-variable-reference to point to life-safety-zone-1 / accepted-modes. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.

CVSS 3.1 · 8.6 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack
CVE-2026-47258

BACnet Stack: Stack-based buffer overflow in Notification Class AddListElement recipient-list decoding

BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.4, 1.5.1, and 1.6.0, a stack-based out-of-bounds write exists in the Notification Class object implementation when handling AddListElement for the recipient-list property. This issue has been patched in versions 1.4.4, 1.5.1, and 1.6.0.

CVSS 3.1 · 8.2 High EPSS n/a KEV · Not listed
Vendors
Bacnetstack
Products
Bacnet Stack