CVE-2026-84682 is a command injection vulnerability in the TDDPv2 service on TP-Link Archer AX90 v1 devices. An unauthenticated attacker on an adjacent network can exploit the setProductVer command handler to execute arbitrary OS commands as root during device boot. This leads to full device compromise with root privileges.
Vvveb CMS versions prior to 1.0.8.6 contain a Server-Side Request Forgery (SSRF) vulnerability. The SSRF guard only resolves IPv4 addresses and does not inspect IPv6 addresses, allowing authenticated admin users to bypass private-range checks using IPv6 literals or domains with only AAAA records. This enables reading of internal-only services and cloud metadata, including IAM credentials. The issue is patched in version 1.0.8.6.
Vvveb CMS versions prior to 1.0.8.6 contain a cross-site scripting (XSS) vulnerability due to improper sanitization of HTML input. Specifically, the HTML sanitizer fails to remove event-handler attributes when a tag includes a greater-than character inside a quoted attribute value. This allows low-privilege users (authors or contributors) to inject JavaScript payloads into post or product content. When other users, including administrators, view or preview this content, the malicious script executes, potentially leading to admin account takeover. The vulnerability has been fixed in version 1.0.8.6.
CVE-2026-55231 is a path traversal vulnerability in givanz Vvveb CMS versions prior to 1.0.8.6. An authenticated admin-panel user with backup access (site_admin role or higher) can exploit a flawed path sanitizer to read and delete arbitrary files on the server. This allows exposure of sensitive files such as database credentials and system files, and deletion of critical configuration files to force a site reinstall and potential takeover. The vulnerability is patched in version 1.0.8.6.
A command injection vulnerability exists in the foreman-tail utility of Foreman due to unsafe use of the eval command. The utility incorporates user-supplied arguments directly into an eval-executed string without sanitization or quoting, allowing a local attacker to execute arbitrary system commands by injecting shell metacharacters. This vulnerability has a CVSS score of 5.3 (medium severity). Red Hat has issued a security advisory with an official fix for affected Red Hat Satellite 6.19 on RHEL 9.
A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods check_blob_push_org_label and get_matching_products_from_org take user-supplied labels directly from the request path and interpolate them into raw SQL fragments. This flaw is accessible to a user with only the create_personal_access_tokens permission, even if the user access is restricted, with no Organization or Location assigned.
A command injection vulnerability (CVE-2026-12545) exists in rubygem-hammer_cli due to insecure interpolation of the $EDITOR environment variable into Ruby's system() method. This flaw allows an attacker with limited privileges to execute arbitrary commands via shell metacharacters. The vulnerability affects Red Hat Satellite versions 6.19 up to but not including 6.19.5. A security update addressing this issue is available from Red Hat.
A flaw was found in the X.509 client certificate authenticator of Keycloak. When CRL Distribution Point checking is enabled, the server fails to properly validate the file paths provided in a client certificate. An attacker can provide a specially crafted certificate that causes the server to attempt to read sensitive files from the local system or exhaust memory by loading extremely large files, potentially leading to information disclosure or a system crash.
A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.
A critical vulnerability (CVE-2026-96659) affects Foreman versions 6.19.0 through 6.19.4. It allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. This can expose sensitive data such as host root passwords. Furthermore, if Safemode protections are disabled, the vulnerability may enable arbitrary command execution as the Foreman system account. A security update is available that addresses this issue.
An out-of-bounds write vulnerability exists in Apache HTTP Server on Windows when processing file paths that use 8.3 short names which may expand to longer paths. This affects Apache HTTP Server versions from 2.4.0 through 2.4.68. The vulnerability could lead to memory corruption due to improper handling of path expansions.
A missing authentication vulnerability exists in the Kernel Memory Access Driver (PSKMAD) used by WatchGuard endpoint security products. This flaw allows a local, authenticated attacker to bypass the driver's access-control handshake and issue arbitrary privileged commands. Exploitation can lead to disclosure of kernel and process memory. The vulnerability is classified as critical due to its potential impact on system confidentiality and integrity. No affected versions or patch information are provided. There are no known exploits in the wild at this time.
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than its actual presence in the incoming HTTP request. Because a host actively undergoing provisioning has an unexpired token in the database, the server's valid_host_token? method evaluates to true, granting access to the kickstart template even if the requester provides no token at all in the URL.
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intended to fetch specific log entries, an attacker with sudo permissions to execute this rake task can inject shell metacharacters (such as ;, ", or |) to break out of the intended command and execute arbitrary code.
A vulnerability in Foreman’s foreman-rake initialization logic allows Server-Side Template Injection (SSTI) and insecure deserialization, creating a multi-stage execution chain. This flaw can lead to remote code execution and full infrastructure compromise. The issue is tracked as CVE-2026-12544 with a high severity score of 7.7. Red Hat has released an official security advisory with patches addressing this and related vulnerabilities in Red Hat Satellite 6.19 for RHEL 9.
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (during imports) before passing them to a Ruby system() call for execution. An attacker with permissions to execute foreman-rake (e.g., via a restricted sudo configuration) can append malicious shell commands to the provided file paths.
Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3.4.2 might allow remote authenticated users with PersistentVolume creation permissions to inject arbitrary mount options via comma-separated values in the mounttargetipmap volumeAttribute.
To remediate this issue, users should upgrade to version v3.5.0 or later.
HCL BigFix Service Management has an improper input validation vulnerability that allows attackers to inject unvalidated or malformed data into the application. This could lead to injection attacks or errors in downstream processing. The vulnerability has a medium severity rating with a CVSS score of 4.3. There is no information about affected versions or available patches. No known exploits are reported in the wild.
CVE-2026-15911 is a high-severity vulnerability in the Confluent Kafka Python client's integration with HashiCorp Vault KMS. It involves improper TLS certificate validation, which could allow a remote attacker to obtain sensitive information. The affected versions include all releases up to and including 2.14.2. No known exploits are reported in the wild, and no patch information is provided in the input data.
CVE-2026-68496 is a high-severity vulnerability in the Smile parser component of FasterXML jackson-dataformats-binary. The parser fails to enforce the maxNameLength limit on JSON object property names, allowing an attacker to submit a Smile document with an unboundedly long property name. This leads to uncontrolled memory allocation and potential denial of service due to memory exhaustion. The issue affects multiple jackson-dataformats-binary versions starting from 2.16.0 where the constraint was introduced but not enforced. No special privileges are required to exploit this vulnerability.