BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
A denial of service vulnerability exists in the BACnet Stack open source protocol library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the ReadPropertyMultiple handler can enter an infinite loop when processing a malformed request packet missing expected closing tags. This flaw has been patched in the specified fixed versions.
CVE-2026-52788 is a high-severity vulnerability in the bacnet-stack open source BACnet protocol library for embedded systems. The flaw exists in the bsc_node_parse_urls() function, which improperly handles space-separated WebSocket URIs from BACnet/SC Address Resolution ACK messages. This leads to out-of-bounds writes beyond the bounds of a fixed-size array, potentially causing memory corruption. The issue affects versions prior to 1.4.5, 1.5.1, and 1.6.0 and has been fixed in these releases.
CVE-2026-52787 is a high-severity vulnerability in the BACnet Stack open source protocol library for embedded systems. It involves an incorrect calculation of buffer size leading to a reachable out-of-bounds write when encoding the device.address-binding property. This flaw affects versions prior to 1.4.5, 1.5.1, and 1.6.0-rc2. The issue has been fixed in these versions.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.
A denial-of-service vulnerability exists in bacnet-stack prior to version 1.5.1. The flaw affects the default demo server built from the unmodified apps/server/main.c and allows remote attackers to cause uncontrolled resource consumption. This issue has been addressed in version 1.5.1.
CVE-2026-121808 is a high-severity vulnerability in elixir-grpc's grpc and grpc_core components that improperly handle highly compressed data in gRPC message bodies. The vulnerability arises because the decoding function uses :erlang.binary_to_term/2 without limiting the size of the decompressed data, allowing unauthenticated attackers to send compressed messages that expand to very large terms, exhausting server memory. This affects grpc versions from 0.4.0 up to but not including 1.0.0, and grpc_core versions from 1.0.0 up to but not including 1.1.0. Fixed versions are 1.0.0 for grpc and 1.1.0 for grpc_core.
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.
The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.
sysPass versions 3.0.1 through 3.2.11 have an authentication bypass vulnerability in the install/install handler. This flaw allows unauthenticated attackers to reinstall an already-installed instance without checking if the application is already installed. Exploitation enables overwriting configuration files, redirecting the application to attacker-controlled databases, creating administrator accounts, and executing commands via serialized gadget chains.
OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.
CVE-2026-95379 is a high-severity relative path traversal vulnerability in Zenitel VSFF devices (VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT) with software versions from 10.0.3.0 up to but not including 10.1.3.0. It affects the certificate.deleteCertificate JSON-RPC method in the turbineweb web interface, allowing authenticated administrators to delete arbitrary files as root by exploiting a relative path (../) in the file_name parameter. This can lead to denial of service or device inoperability by removing critical system files, and can weaken device security by deleting files such as firewall rules or certificate trust stores. The issue is fixed in version 10.1.3.0.
Zenitel Connect versions before 1.11.0 expose production JavaScript source maps via the web interface without requiring authentication. This exposure allows remote attackers to access the complete front-end source code, revealing API usage and internal client logic. The vulnerability is fixed in version 1.11.0.
CVE-2026-126818 is a vulnerability in the MongoDB Ruby Driver where automatic field-level encryption is not applied to certain fields when using class inheritance in the data model. This results in sensitive data being stored in plaintext in the database without any error or warning. An attacker with read-only access to the database collections but no access to the encryption key store could read these sensitive values.
CVE-2026-105624 is a vulnerability in Zenitel Connect versions before 1.11.0 where the login flow applies a per-account lockout after repeated failed login attempts. This lockout can be triggered remotely by attackers using known or guessed usernames, causing a denial of service by temporarily locking targeted user accounts from accessing the web interface. The issue does not affect intercom call handling. The vulnerability is fixed in version 1.11.0.
CVE-2026-105622 is a vulnerability in Zenitel Connect before version 1.11.0 where the WAMP-CRA authentication mechanism does not restrict excessive authentication attempts. This allows remote attackers to perform unlimited password guessing attempts without account lockout or rate limiting. The vulnerability is mitigated by a strong password policy requiring at least 12 characters with mixed character types. The vulnerable authentication path was removed in version 1.11.0.
CVE-2026-123635 is a resource management vulnerability in elixir-grpc grpc_server versions from 1.0.0 up to but not including 1.1.0. It allows a client to stall all subsequent calls on a shared HTTP/2 connection by sending calls that the server refuses while their DATA frames are still in flight. This causes the connection's flow-control window to be depleted, blocking further request bodies on that connection until deadlines expire. Other connections remain unaffected. The issue is fixed in version 1.1.0.
CVE-2026-126817 is a vulnerability in the MongoDB Ruby Driver's Mongoid ODM automatic client-side encryption schema generation. When multiple models map onto the same storage location, values intended for encryption may be stored in cleartext without any error or warning. This allows a user with read-only database access, but no encryption keys, to read sensitive data in clear form.