CVE-2026-125715 is a vulnerability in Samsung Opensource mTower where the system lacks proper access control for Trusted Application (TA) sessions. This flaw allows a Normal World application to open TA sessions, invoke their commands, or close existing sessions if their identifiers are known. The impact varies depending on which TA is affected.
CVE-2026-123717 is an OS command injection vulnerability in Eclipse Otterdog up to version 1.7.1. It affects the pass and bitwarden credential providers, allowing a user who can modify an organization configuration to execute arbitrary commands with the privileges of the operator running Otterdog. This is achieved via crafted secret references or credential identifiers resolved during the 'otterdog apply' operation.
Zoho Corporation ManageEngine DDI Central versions prior to 6201 contain a SQL injection vulnerability in the HA replication username handling. This flaw allows an attacker with high privileges to execute commands as the PostgreSQL service account. The vulnerability is tracked as CVE-2026-12572 and has a CVSS score of 7.2, indicating high severity. A fixed version, 6201, is available to remediate this issue.
Zoho Corporation ManageEngine DDI Central versions below 6500 contain a vulnerability allowing unauthenticated updates to the GSS-TSIG keytab via the Linux Node Agent. This missing authentication for a critical function can lead to denial of service. The issue is fixed in version 6500.
Zoho Corporation ManageEngine DDI Central versions below 6500 contain a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This flaw allows cluster-scoped operators to inject specially crafted Unicode characters that can lead to execution of unintended device commands. The vulnerability is rated high severity with a CVSS score of 8. A fix is available in version 6500.
Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to obtain an API token for another user's account via a crafted login link. Starting a CLI login with POST /api/auth/cli_session needs no authentication and returns a polling token, a confirmation URL that carries that token, and a confirmation code. When a signed-in user opens that URL and clicks Confirm, NervesHub.Accounts.verify_cli_session_token/2 creates an API token for the user's account and stores it on the login, and the next poll of GET /api/auth/cli_session/<token> returns it to whoever started the login.
The confirmation code is only displayed and is never compared with anything, so it cannot show that the person confirming is the one who started the login. The confirm form carries a CSRF token and the page cannot be framed, so the attacker has to persuade the user to open the link and click the button themselves.
This issue affects nerves_hub: from 2.5.0 before 2.5.3.
CVE-2026-120286 is a missing authorization vulnerability in nerves-hub's nerves_hub_web component affecting device and deployment group management pages. Authenticated organization members with only view privileges can perform actions reserved for manage roles, such as modifying device certificates, tags, locations, deployment groups, and firmware delta builds. This flaw affects versions from 1.0.0 up to but not including 2.5.3 and is fixed in version 2.5.3.
CVE-2026-120997 is an improper session invalidation vulnerability in nerves_hub_web affecting versions from 1.0.0 up to but not including 2.5.3. It allows organization members who are removed or demoted to continue acting with their previous roles on open dashboard pages, device consoles, and local shell channels until those sessions are reloaded or disconnected. The issue arises because role checks occur only once at page load or channel join, and tokens used for console access remain valid for 24 hours and are not revoked on sign-out. This can lead to unauthorized actions persisting beyond membership changes. The vulnerability has a low CVSS score of 2.3 and is fixed in version 2.5.3.
CVE-2026-120730 is an authorization bypass vulnerability in nerves_hub_web affecting versions from 1.0.0 up to but not including 2.5.3. It allows an authenticated user with device management privileges in one organization to write data into other organizations by manipulating org_id, product_id, and deployment_id fields in device API requests and forms. Although the user cannot control devices already belonging to other organizations or upload firmware to them, devices can be placed into another organization's deployment group or product, causing them to receive that organization's firmware. The issue is fixed in version 2.5.3.
A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.
A flaw was found in cockpit-storaged. A Tang keyserver address read from a clevis token in a LUKS header is concatenated into curl's argument vector without a "--" separator. An address beginning with "-" is parsed by curl as an option instead of a hostname, allowing an attacker who can attach a crafted LUKS/clevis block device (for example, a local unprivileged user with an active console or desktop login session) to have an administratively-privileged Cockpit user unknowingly trigger curl option injection when editing the device's Tang keyserver settings. This can lead to arbitrary file read or write as the Cockpit session user.
CVE-2026-120999 is an improper authentication vulnerability in nerves_hub_web affecting versions from 2.3.0 up to but not including 2.5.3. It allows an attacker to register another person's email address and gain access to that person's account once they sign in via Google or follow an email confirmation link. The flaw arises because the system signs in users and confirms emails without verifying ownership of the email address, enabling account sharing without proper authorization. The issue is fixed in version 2.5.3.
CVE-2026-120295 is an incorrect authorization vulnerability in the nerves_hub_web component of nerves-hub. It allows an authenticated user with manage role in one organization and only view role in another to move devices into the second organization's product improperly. This occurs because the system checks membership in the target organization but does not verify the user's manage role there. The vulnerability affects versions from 1.0.0 up to but not including 2.5.3 and was fixed in version 2.5.3.
A use-after-free flaw was found in GStreamer core buffer value deserialization. When serialized buffer text contains an invalid character, an error path frees a mapped buffer before unmapping it. Applications that parse untrusted caps or structure data can reach a freed-buffer read and may crash. A network-facing GStreamer Data Protocol receiver can process such caps data without user interaction; further impact has not been established.
Two vulnerabilities in Helmholz myREX24V2/myREX24V2.virtual allow unauthenticated remote code execution, leading to complete compromise of confidentiality, integrity, and availability.
The Bender EDGE500IP device contains vulnerabilities in its Linux kernel TLS implementation (CVE-2025-39682) and the AF_ALG crypto socket interface (CVE-2025-39964). These vulnerabilities can be exploited by an attacker with local code execution capabilities to compromise the confidentiality, integrity, and availability of the device. Exploitation in the wild is confirmed, and the issue is considered critical. No specific affected versions or patch information is provided.
Multiple vulnerabilities have been identified in Helmholz myREX24V2 and myREX24V2.virtual products. These vulnerabilities collectively can lead to a total loss of confidentiality, integrity, and availability of the affected systems. The specific CVE entries provide detailed information on each individual flaw. No affected versions or patch information are provided at this time.