CVE-2026-95377

OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning

OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal. The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.

CVSS 4.0 · 9.4 Critical EPSS 1.2% KEV · Not listed

Vendors

Zenitel

Products

Vsff6 Vsff8 Vsff8mn and 2 more

CVE-2026-129131

Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints

Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Gameyfin

Products

Gameyfin

CVE-2026-129130

agent-device 0.21.36 Local File Disclosure via file:// Navigation in Open Command

agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read any plaintext file readable by the daemon account.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Callstack

Products

Agent-device

CVE-2026-129126

C-Kermit before 11.1.515 Heap Buffer Overflow via putsrv() Packet Decoding

C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129125

C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY

C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129124

C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE

C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.

CVSS 4.0 · 9.2 Critical EPSS 1.3% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129123

C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies

C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129122

C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation

C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129121

C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE

C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129120

C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET

C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129119

C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND

C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129118

C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129117

C-Kermit 8.0.200 before 11.1.515 Missing Hostname Verification in AUTHENTICATION SSL

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate validation vulnerability that allows machine-in-the-middle attackers to impersonate Telnet servers because ssl_reply() never calls ssl_check_server_name(). Attackers can refuse START-TLS, offer Telnet AUTHENTICATION SSL, and present any trusted CA certificate to capture user credentials and session data.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-129116

C-Kermit 7.0.197 before 11.1.515 IKSD Authentication Bypass via Refused Certificate Login

C-Kermit from 7.0.197 before 11.1.515 contains an authentication bypass vulnerability in the IKSD SSL build that leaves Telnet authentication state at AUTH_VALID after a refused certificate login. Attackers holding a trusted certificate mapped to a refused account can log in as any other account with any password, gaining that account's shell access.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Openkermit

Products

C-kermit

CVE-2026-126091

iDentalSoft website information exposure

Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Identalsoft

Products

Identalsoft

CVE-2026-124041

Catalis WebPro SQL Injection

Catalis/Patriot Properties WebPro 5.0 allows a remote unauthenticated attacker to execute arbitrary SQL queries against the underlying MSSQL database, enabling exfiltration of sensitive property and taxpayer information.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Catalis

Products

Webpro

CVE-2026-123965

Jet Admin cloud platform prompt injection

A prompt injection vulnerability in all versions of Jet Admin Cloud Platform allows a remote attacker with a free account to expose sensitive .env configuration files and exfiltrate critical credentials. Mitigated via sandbox component around October 29, 2026.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Jet Admin

Products

Jet Admin Cloud Platform

CVE-2026-129171

NginxPulse 1.5.0 before 1.6.26 SQL Injection via /api/stats/:type

NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to append SQL via the id and locationType parameters of /api/stats/:type. Attackers can close the quoted table-name identifier and use error-based output to read database contents, and read or write server files via PostgreSQL superuser functions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Likaia

Products

Nginxpulse

CVE-2026-129169

PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Jinnrry

Products

Pmail

CVE-2026-129168

PMail 2.9.1 through 2.9.8 Stored XSS via Inline HTML Attachments

PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jinnrry

Products

Pmail