A flaw has been found in Edimax BR-6208AC 1.32. Affected by this vulnerability is an unknown functionality of the file /goform/mp. Executing a manipulation can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-115770 is a critical vulnerability in pocket-id versions 2.2.0 through 2.11.x where insufficient verification of email verification tokens allows an attacker to change an account's email address and mark it as verified without invalidating the original token. This can lead to an attacker linking their identity to another user's account if the relying application trusts verified emails for account matching. The issue is fixed in version 2.12.0.
VitaFit cloud API versions before 2026-10-30 have an authentication bypass vulnerability that allows remote attackers to impersonate users by submitting linked Google or Facebook account identifiers without proof of ownership. This flaw enables attackers to fully access victim accounts, modify profiles, and delete authentication records, blocking legitimate user access. The vulnerability is critical and has been fixed as of 2026-10-30.
GLPI versions from 11.0.0 up to but not including 11.0.8 contain an authentication bypass vulnerability that allows unauthenticated users to skip two-factor authentication by using a crafted URL during login. This flaw is fixed in version 11.0.8.
VitaFit cloud API versions before 2026-10-30 have a broken access control vulnerability that allows any authenticated user to obtain temporary AWS credentials via the POST /front/user/s3/token/ endpoint. These credentials are improperly scoped, enabling attackers to list the shared storage bucket and read or overwrite files belonging to other users. This results in unauthorized cross-user data access and manipulation. The vulnerability has a critical severity with a CVSS score of 9.3 and was fixed on 2026-10-30.
Red Hat Cost Management On-Premise provides cost visibility and analysis for on-premise OpenShift environments. A security advisory was issued for an updated container image including the latest bug fixes and enhancements. One notable vulnerability (CVE-2026-102633) affects the expat XML parser library used in Red Hat products on 32-bit systems, where an integer overflow in memory allocation can lead to denial of service or memory corruption. This vulnerability requires specially crafted XML input and has high attack complexity. No direct fixes are currently available for this flaw in some Red Hat Enterprise Linux versions, and mitigation options are limited. The advisory covers multiple CVEs but does not specify fixes for all. The update is available via the Red Hat container registry.
Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, the unauthenticated /api/opds/proxy route in apps/readest-app/src/app/api/opds/proxy/route.ts accepted an attacker-controlled URL and fetched it server-side without restricting the scheme, blocking private, loopback, link-local, or metadata hosts, or revalidating destinations during automatic redirect following. The route also accepted caller-controlled outbound headers and Authorization values and reflected the upstream status and response body. A remote attacker could use the service as an open request proxy and, on Node, Docker, or other self-hosted deployments with internal-network access, retrieve cloud metadata or internal-service responses. Cloudflare Workers deployments restrict access to link-local and private destinations, which reduces the internal-network impact there, but the unauthenticated public fetch-and-reflect behavior remains. This issue is fixed in version 0.11.10.
A critical path traversal vulnerability exists in the Comfast CF-WR632AX version 2.6.0.1 within the Multipart Parser component of the /usr/bin/webmgnt file. This vulnerability allows remote attackers to manipulate the filename argument to traverse directories. Exploit code is publicly available, and the vendor has not responded to disclosure attempts.
vtenext versions before 25.02.1 contain an authentication bypass vulnerability that allows unauthenticated attackers to change any account password without token verification. By exploiting the hub/rpwd.php endpoint with a known valid user_name, attackers can invoke a password change action and gain administrator access if two-factor authentication is not enabled.
A critical authentication bypass vulnerability exists in Linksys E5350 version 1.0.00.037 in the Setup Wizard component. The flaw is triggered by manipulating the wizard_router_pwd argument in the save_settings function of /wizard/apply.cgi. This vulnerability can be exploited remotely without authentication, potentially allowing full compromise. Public exploit code is available, but the vendor has not responded or issued a patch.
Sonatype Nexus Repository 3 Pro has a vulnerability where it does not verify the local account status when users authenticate via configured SAML or OAuth2/OpenID Connect identity providers. This allows users whose local accounts are disabled or locked to regain access if they have valid credentials at the identity provider, receiving a new session with their assigned roles.
Yealink Plug-in Softwares prior to version 2.35.219.0 contain an unauthorized file write vulnerability that can be exploited under certain conditions to achieve remote code execution. This vulnerability is critical and has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability.
A critical OS command injection vulnerability exists in Linksys E5350 version 1.0.00.037 in the /wizard/apply.cgi file. The flaw arises from manipulation of the ping_ip or traceroute_ip arguments, allowing remote attackers to execute arbitrary OS commands. Public exploit code is available, but the vendor has not responded or provided a fix.
A critical OS command injection vulnerability exists in the Ping Diagnostic component of Linksys WRT54GL version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the ping_ip argument allows remote attackers to execute arbitrary OS commands. The vulnerability is publicly known with available exploit code. However, the affected product is no longer supported by the vendor, and no patch or official response has been provided.
A critical remote command injection vulnerability exists in the Traceroute Diagnostic Function of Linksys WRT54GL firmware version 4.30.18. The flaw is in the system function of the apply.cgi file, where manipulation of the traceroute_ip argument allows an attacker with high privileges to execute arbitrary OS commands. This vulnerability affects an unsupported product, and no vendor response or patch is available. Public exploit code has been disclosed.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. From 0.7.1 until 2.2.2, the /auth/saml/callback endpoint decoded SAML XML, used its NameID and attributes to resolve or provision a user, and minted a gpustack_session JWT without calling OneLogin_Saml2_Auth.process_response to verify the signature, issuer, audience, destination, or time conditions. Any network client could submit an identity for an existing user, including an administrator, or provision a new non-administrator account, even when SAML was not configured. Response and Assertion identifiers were not consumed, so captured signed responses could also be replayed. This issue is fixed in version 2.2.2.
GPUStack is an open-source GPU cluster manager for AI model serving and GPU instance provisioning. Prior to 2.2.0, get_current_user in gpustack/api/auth.py treated a loopback request source as the built-in administrator when force_auth_localhost was false, which was the default. A remote request could appear to originate from 127.0.0.1 because client_ip_getter accepted a same-host reverse proxy peer or a client-supplied X-GPUStack-Real-IP loopback value. The bypass allowed unauthenticated administrative access, including user and model changes, persistent administrator API-key creation, disclosure of worker and cloud-provider secrets, and code execution through POST /v2/inference-backends/from-yaml. Exploitation was observed in the wild against a 2.1.1 deployment. This issue is fixed in version 2.2.0.
CVE-2026-97693 is a critical command injection vulnerability in the Yuxi platform versions from 0.6.0.beta1 up to but not including 0.7.1. It allows a low-privileged authenticated user with command execution in their own Docker sandbox to access and manipulate other tenants' sandboxes and data without needing administrator credentials. The vulnerability arises from insufficient isolation between Docker sandboxes and trusted services, enabling cross-tenant API access, file and secret exposure, sandbox management, and potential command execution in shared internal services if default credentials remain unchanged. The issue is fixed in version 0.7.1, but deployments must also rotate persisted credentials for PostgreSQL, Neo4j, and MinIO if they were set to default values, as upgrading alone does not rotate these credentials.
CVE-2026-82418 is a critical use-after-free vulnerability in IBM Watson Speech Services Cartridge versions 4.0.0 through 5.4.0. This flaw could allow a remote attacker to execute arbitrary code without any user interaction or privileges.