The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint.
Cudy TR3000 versions before 2.5.42 have a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading specially crafted OpenVPN private or tls-auth keys. The vulnerability arises from improper encoding or escaping of output, enabling attackers to inject directives that bypass security restrictions and execute arbitrary code with root privileges.
Cudy TR3000 devices prior to version 2.5.42 have a mass assignment vulnerability in the vpn.set_conf App RPC method. This flaw allows authenticated administrators to inject arbitrary OpenVPN server options, including enabling malicious commands executed as root via the openvpn-hotplug wrapper. The vulnerability is fixed in version 2.5.42.
CVE-2026-129102 is a command injection vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device versions before 2.5.42. Authenticated administrators can exploit improper neutralization of CRLF sequences in the IPsec keyexchange field of the vpn.set_conf RPC method to execute commands as root. This is achieved by injecting newlines to append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin executes with root privileges when an attacker-controlled peer establishes the CHILD_SA.
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.
CVE-2026-129104 is a vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device before version 2.5.42. It involves improper neutralization of CRLF sequences allowing authenticated administrators to inject dnsmasq configuration directives via the net.set_dhcp leasetime field. This can lead to DNS manipulation or service disruption on LAN clients. The issue is fixed in version 2.5.42.
CVE-2026-129105 is a high-severity vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device before version 2.5.42. It involves improper neutralization of CRLF sequences, allowing authenticated administrators to inject arbitrary pppd options via crafted L2TP credentials. This can lead to unauthorized modification of pppd options files and potentially affect the root pppd process. The issue is fixed in version 2.5.42.
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
The npm package @ewms/el-bootstrap contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised device. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
A missing authorization vulnerability exists in CleverReach® WP plugin versions up to 1.5.26. This flaw allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to partial confidentiality, integrity, and availability impacts.
Eclipse BaSyx Go Components versions up to and including 1.1.2 contain an authorization bypass vulnerability in ABAC-enabled deployments of the Submodel Repository and the AAS Environment. This flaw allows an authenticated user with read access to a single Submodel Element to retrieve all elements of that Submodel via the list route, exposing unauthorized data. The issue is resolved in version 1.1.3.
The CCC Attestation SIG attested-tls-poc project contains a time-of-check time-of-use (TOCTOU) vulnerability in its attestation process. The vulnerability arises because evidence is only appraised once during the TLS handshake, with no re-attestation after the handshake completes. This allows attackers with local access to the attesting endpoint to modify workload code, data, configuration, or attached devices such as GPUs, while peers continue to trust the original attestation evidence.
xschem versions 2.9.9 through 3.4.7 contain an out-of-bounds read vulnerability in the read_xschem_file() function within src/save.c. This flaw occurs when processing embedded-symbol records that lack a preceding instance, allowing crafted schematic files starting with a "[" record to cause memory reads below the instance array and crash the application.
An OS command injection vulnerability (CWE-78) exists in the network-configuration handling of the management service (uavmonitor_usbv1) on the 1300 communications board of DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and board firmware versions 02.00.07.12 through 02.00.08.40. This flaw allows an unauthenticated attacker on the local network to execute arbitrary commands as root by sending crafted configuration values to TCP port 16000. The injected commands persist across reboots. The affected products are no longer supported and no firmware fixes are available.
CVE-2026-128907 is a vulnerability in the management service (uavmonitor_usbv1) of the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and affected 1300 communications board firmware versions. The service lacks authentication for critical functions, allowing unauthenticated local network attackers to read sensitive device information and change configuration settings via TCP port 16000 or the USB operator port. This vulnerability affects discontinued products with no available firmware fix.
xschem versions 2.9.9 through 3.4.7 contain a heap out-of-bounds write vulnerability in the read_dataset() function within src/rawtovcd.c. This flaw arises from an unchecked variable index, allowing attackers to craft malicious ngspice .raw files that cause heap memory corruption during conversion with rawtovcd.
Dell PowerStore contains a Server-Side Request Forgery (SSRF) vulnerability that allows a high-privileged attacker to access internal network services from the appliance. The vulnerability has a low severity with a CVSS score of 3.8. No specific affected versions or patches are currently identified.
A critical deserialization of untrusted data vulnerability (CWE-502) exists in Elextensions ELEX WordPress HelpDesk & Customer Ticketing System versions up to 3.3.9. This flaw allows object injection, potentially leading to full system compromise. The vulnerability has a CVSS 3.1 score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation details are provided in the available data.
A stored cross-site scripting (XSS) vulnerability exists in Unbounce Landing Pages through version 1.1.6. This vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be executed in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.