Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
CVE-2026-86330 is an OS command injection vulnerability in the set_hostname_internal function of NooBaa's cluster_internal_api component within Red Hat OpenShift Data Foundation 4. The flaw arises because the hostname parameter is passed directly to a shell command without proper sanitization. An authenticated attacker with administrative privileges can exploit this to execute arbitrary commands on the host system with the privileges of the NooBaa process. The vulnerability has a high severity rating with a CVSS score of 7.2.
A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archive Link Creation. This manipulation of the argument linkedFolder causes path traversal. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large request bodies that exhausts buffers in RAM, causing out-of-memory conditions and crashing the fh-node process, resulting in denial of service. The successful attack depends on the current memory usage of the device which is not under full control of the attacker. Critically, due to CVE-2026-82930 all endpoints can be queried unauthenticated, so any user on LAN can perform this attack.
This issue was fixed in version 3.0.30
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit these known flaws to execute arbitrary code, access sensitive data, or cause a denial of service on the device.
Vulnerable components were updated or hardened, if update was not possible in version 3.0.30
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions.
This issue was fixed in version 3.0.30
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service.
This issue was fixed in version 3.0.30
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to manipulate building automation devices.
This issue was fixed in version 3.0.30
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception.
This issue was fixed in version 3.0.30
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes.
This issue was fixed in version 3.0.30
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. The manipulation of the argument wifi_info results in information disclosure. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.
CVE-2026-101054 is a medium severity vulnerability in Thinkware U3000 version 1.02.04. It involves improper access controls in the TCP Service component, specifically in the get_file function accessing /tmp/wpa_supplicant.conf. The vulnerability allows remote attackers to exploit the flaw without authentication or user interaction. Public exploit code is available, but no vendor response or patch has been provided.
CVE-2026-78424 is an OS command injection vulnerability in SUSE NeuVector affecting versions before 5.4.11, 5.5.4, and 5.6.2. It allows authenticated users with specific write permissions or access to internal gRPC certificate keys to execute arbitrary OS commands in a privileged container, potentially compromising the entire worker node. The vulnerability has a high severity with a CVSS score of 8.8.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes.
This issue affects Agentis: from 4.44 before 4.6.
A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
The District of Columbia Department of Health Care Finance (DHCF) experienced a data exposure affecting nearly 400,000 Medicaid and DC Healthcare Alliance beneficiaries enrolled between 2023 and 2026. The exposure was due to two reports on the DHCF website that contained hidden personal information accessible to unauthorized users. The exposed data included Medicaid IDs, provider names, dates of birth, race, gender, ethnicity, and ward, but did not include Social Security numbers, names, or financial information. The breach was not caused by hacking but by unintended data exposure. DHCF removed the reports upon discovery in July 2026 and notified affected individuals and the US Department of Health and Human Services. The agency has no evidence that the information was misused but advises vigilance against identity theft and fraud.
CVE-2026-94194 is a medium severity vulnerability in the elixir-mint mint HTTP client library. It involves inconsistent interpretation of HTTP/1 responses, specifically in handling Transfer-Encoding headers with multiple codings and connection persistence after HTTP/1.0 responses. This can lead to HTTP request/response smuggling where a malicious HTTP/1 server desynchronizes an intermediary and the Mint client on a pooled connection, causing response poisoning for subsequent requests sharing the connection.
CVE-2026-92103 is a resource allocation vulnerability in the elixir-mint mint HTTP/2 client library. A malicious HTTP/2 server can cause the client to buffer up to about 16 MiB of data per connection by sending frames with large declared payloads but withholding the last byte. This leads to excessive memory consumption on the client side. The issue affects mint versions from 0.1.0 up to but not including 1.10.2.
CVE-2026-91043 is a high-severity vulnerability in the elixir-mint mint library affecting versions from 1.1.0 up to but not including 1.10.2. It involves improper resource allocation limits in the HTTP/2 client implementation, allowing a malicious HTTP/2 server to cause excessive memory consumption on the client by exploiting how header sizes are enforced. This can lead to denial of service by exhausting the memory of the process or the entire virtual machine.