Threat database

Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.

pfSense CE versions up to and including 2.9.0 contain an OS command injection vulnerability in the OpenVPN connect script. Authenticated VPN users via RADIUS or LDAP can exploit this by using crafted usernames with special shell characters to execute commands as root. This vulnerability allows privilege escalation through improper input neutralization in the openvpn.connect_async.sh script.

Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.

CVE-2026-111222 is a high-severity vulnerability in Netgate pfSense CE up to version 2.9.0. It allows authenticated users with General Setup privileges to inject php.ini directives by submitting an unvalidated timezone value. This injection can lead to execution of PHP code as root after system boot or php-fpm restart.

CVE-2026-111221 is a configuration injection vulnerability in Netgate pfSense CE up to version 2.9.0. Authenticated users with L2TP or PPPoE Server edit privileges can inject commands by submitting an unescaped RADIUS shared secret containing special characters. This allows execution of arbitrary commands as root when a session starts, due to improper neutralization of CRLF sequences.

pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.

Netgate pfSense CE versions up to 2.9.0 have a CRLF injection vulnerability in the services_pppoe_edit.php component. This flaw allows privileged users with PPPoE Server Edit rights to inject malicious entries into the mpd.secret file via unvalidated username POST fields. By injecting a line starting with '!', attackers can cause the mpd5 daemon to execute commands as root when a PPPoE client authenticates.

Netgate pfSense CE 2.7.0 through 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Traffic Shaper Limiters privileges to execute root commands by tampering with the limiter number field. Attackers can submit a malicious hidden 'number' value when editing a limiter, then delete it so delete_queue() passes the unquoted value to dnctl via /bin/sh as root.

Netgate pfSense CE up to version 2.9.0 contains an OS command injection vulnerability that allows authenticated users with Virtual IP edit privileges to execute arbitrary commands as root. The issue arises from improper validation of the CARP VHID value, which can include shell metacharacters. This vulnerability is triggered during interface IP alias configuration or when rendering CARP status, leading to command execution with elevated privileges.

Netgate pfSense CE up to version 2.9.0 contains an OS command injection vulnerability that allows authenticated users with gateway edit privileges to execute arbitrary commands as root. This occurs via injection of shell metacharacters into an IPv6 link-local zone index when setting a gateway Monitor IP. The vulnerability arises because the zone value is not properly validated or escaped before being passed to the dpinger shell command.

Netgate pfSense CE through 2.9.0 contains an OS command injection vulnerability that allows authenticated users to execute commands as root by supplying a crafted wireless parent interface name. Attackers with limited Wireless Edit or Interface Assignments privileges can submit values like ath0;<cmd> via interfaces_wireless_edit.php or interfaces_assign.php, which interface_wireless_clone() interpolates unescaped into an ifconfig shell command.

Netgate pfSense CE versions 2.7.0 through 2.9.0 contain an OS command injection vulnerability. Authenticated users with QinQ edit privileges can exploit this flaw by saving a crafted parent interface name that is not properly validated. This input is then interpolated into ifconfig shell commands, allowing execution of arbitrary commands with root privileges.

CVE-2026-109131 is a stored cross-site scripting (XSS) vulnerability in the Hub collection module documentation renderer of Red Hat Ansible Automation Platform 2. The vulnerability arises because the UI renders documentation URLs without restricting the URL scheme, allowing script-executing URLs to run in the context of the Hub UI. This affects versions in the 2.6 and 2.7 release branches. The vulnerability requires an authenticated user to view and activate the malicious link. The CVSS score is 5.4, indicating medium severity.

CVE-2026-111235 is a critical authorization bypass vulnerability in the REST API of multiple versions of OpenNMS Meridian and Horizon. The issue arises from case-sensitive HTTP method checks in Spring Security filter chains, allowing requests with non-canonical (e.g., lowercase) HTTP methods to bypass authentication. This enables remote unauthenticated attackers to read monitored inventory and create, modify, or delete resources, including injecting events to manipulate alarms. The vulnerability is fixed by adding terminal deny rules to REST filter chains. Upgrading to Meridian 2024.3.14, 2025.0.11, 2026.0.1 or Horizon 36.0.5 or newer resolves the issue. These products are intended for private network use and should not be exposed directly to the Internet.

A Cross-Site Request Forgery (CSRF) vulnerability exists in python-social-auth's social-core LINE backend prior to version 5.0.2. The vulnerability arises because the LINE backend exchanges an authorization code without validating the returned OAuth state parameter. This flaw allows an attacker to cause a victim to be logged into the attacker's LINE account or link the attacker's LINE identity to the victim's existing account when account linking is enabled. This creates a persistent unauthorized login path. The issue is fixed in version 5.0.2.

CVE-2026-108334 is a vulnerability in Red Hat Connectivity Link 1.4 involving improper neutralization of special elements in an expression language statement. The internal WebAssembly shim used by the Kuadrant operator does not correctly escape values from HTTPRoute match fields, allowing a user with permission to create or modify HTTPRoute objects attached to a shared Gateway to craft values that bypass Gateway-level authentication and rate limiting checks. The request is still forwarded to the backend, potentially allowing unauthorized access or abuse. Red Hat has issued a security update addressing this issue.

AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.2 and 9.1.1, the regular expression returned by router.matchers.slug() contains adjacent greedy repetitions with overlapping character classes. When an application applies this matcher to an attacker-controlled route parameter, a long slug ending in a character rejected by the final assertion causes quadratic backtracking and excessive CPU use. Route matching occurs before route and group middleware, so authentication or rate-limiting middleware attached to the route may not prevent an unauthenticated request from blocking the Node.js event loop and stopping the worker from serving unrelated requests or health checks. This issue is fixed in versions 8.2.2 and 9.1.1.

CVE-2026-57496 is a critical path traversal vulnerability in Labs64 NetLicensing-MCP versions prior to 0.1.8. It allows an authenticated MCP client with a non-administrative API key to exploit improper pathname validation and access plaintext token values. This can lead to recovery of an administrative token, granting broad read, write, and delete access to the NetLicensing account. The issue is fixed in version 0.1.8.

CVE-2026-105660 is a vulnerability in mtrudel bandit versions from 0.6.0 up to but not including 1.13.0. It involves improper validation of the syntactic correctness of input in HTTP request targets, allowing an unauthenticated remote attacker to set conn.host and conn.port to values outside the RFC 3986 host grammar. This can lead to applications generating URLs with attacker-chosen authority components. The vulnerability does not affect message framing and does not allow control characters like CR or LF in conn.host.

CVE-2026-104828 is a cross-site scripting (XSS) vulnerability in htmlunit-neko, an adaptation of NekoHTML used by HtmlUnit. Versions prior to 5.4.0 improperly handle TEXTAREA and TITLE element content by writing decoded character data without entity encoding. This causes entity references inside these elements to be decoded and emitted as raw markup during parse-and-serialize operations, potentially allowing attacker-controlled encoded text to become executable markup in browsers. The issue is fixed in version 5.4.0.