CVE-2026-62972 is an out-of-bounds read vulnerability in the BACnet Stack open source protocol library for embedded systems. The issue occurs in the lighting_command_decode function where nested decoders read beyond the intended buffer boundary due to inconsistent size parameters. This flaw was fixed in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-58265 is an out-of-bounds read vulnerability in the BACnet Stack open source protocol library for embedded systems. The flaw occurs in the BACnet/SC header-option decoder where a BACnet/SC peer can trigger a heap read of up to 3 bytes before authentication. This happens because the function bvlc_sc_decode_proprietary_option() reads fixed offsets without verifying the option's declared header length, and the option-list validator does not enforce a minimum length for proprietary options. The issue has been fixed in versions 1.4.5, 1.5.1, and 1.6.0.
CVE-2026-124278 is an authorization bypass vulnerability in elixir-grpc's grpc_server and grpc libraries. It allows an attacker to cause a handler to act on a resource different from the one specified in the URL of an HTTP-transcoded route by sending a request with a gRPC Content-Type. This occurs because the route's path bindings are applied only in the transcoding clause based on the Content-Type, leading to a mismatch between authorization checks on the URL path and the actual resource processed by the handler.
A remote out-of-bounds write vulnerability (CWE-787) exists in the official router-ipv6 application of the bacnet-stack library prior to versions 1.4.5, 1.5.1, and 1.6.0. This flaw allows an attacker to write beyond the bounds of a global transmit buffer, potentially leading to denial of service or other impacts. The issue has been patched in the specified fixed versions.
Huatian Dynamic OA8000 collaborative office system contains an unauthenticated path traversal vulnerability in /OAapp/jsp/trace/ntkodownload.jsp, where the filename request parameter is used to locate a file without restricting access to an intended directory or rejecting traversal sequences. Attackers can supply ../ sequences to read arbitrary files from the server, such as the Tomcat configuration at ROOT/WEB-INF/web.xml, exposing sensitive configuration, source, and credential material that can enable further compromise. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-11-20.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, there is a library-level memory safety issue that is reachable from an unmodified official sample server (apps/server-basic/main.c) over BACnet/IP resulting in a stack-use-after-return in writable Device string properties. This issue has been patched in versions 1.4.5, 1.5.1, and 1.6.0.
A denial of service vulnerability exists in the BACnet Stack open source protocol library for embedded systems. Prior to versions 1.4.5, 1.5.1, and 1.6.0, the ReadPropertyMultiple handler can enter an infinite loop when processing a malformed request packet missing expected closing tags. This flaw has been patched in the specified fixed versions.
CVE-2026-52788 is a high-severity vulnerability in the bacnet-stack open source BACnet protocol library for embedded systems. The flaw exists in the bsc_node_parse_urls() function, which improperly handles space-separated WebSocket URIs from BACnet/SC Address Resolution ACK messages. This leads to out-of-bounds writes beyond the bounds of a fixed-size array, potentially causing memory corruption. The issue affects versions prior to 1.4.5, 1.5.1, and 1.6.0 and has been fixed in these releases.
CVE-2026-52787 is a high-severity vulnerability in the BACnet Stack open source protocol library for embedded systems. It involves an incorrect calculation of buffer size leading to a reachable out-of-bounds write when encoding the device.address-binding property. This flaw affects versions prior to 1.4.5, 1.5.1, and 1.6.0-rc2. The issue has been fixed in these versions.
BACnet Stack is a BACnet open source protocol stack C library for embedded systems. From versions 1.4.2 to before 1.4.5, and 1.5.0 to before 1.5.1, a signed fileStartPosition taken from AtomicReadFile and AtomicWriteFile stream-access requests is not validated tightly enough before it reaches the RAM file backends. Practical impact includes: reliable denial of service via process crash, out-of-bounds read that may expose adjacent memory contents, or out-of-bounds write that may corrupt heap memory and destabilize the process. This issue has been patched in versions 1.4.5 and 1.5.1.
A denial-of-service vulnerability exists in bacnet-stack prior to version 1.5.1. The flaw affects the default demo server built from the unmodified apps/server/main.c and allows remote attackers to cause uncontrolled resource consumption. This issue has been addressed in version 1.5.1.
CVE-2026-121808 is a high-severity vulnerability in elixir-grpc's grpc and grpc_core components that improperly handle highly compressed data in gRPC message bodies. The vulnerability arises because the decoding function uses :erlang.binary_to_term/2 without limiting the size of the decompressed data, allowing unauthenticated attackers to send compressed messages that expand to very large terms, exhausting server memory. This affects grpc versions from 0.4.0 up to but not including 1.0.0, and grpc_core versions from 1.0.0 up to but not including 1.1.0. Fixed versions are 1.0.0 for grpc and 1.1.0 for grpc_core.
OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal.
The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.
The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.
sysPass versions 3.0.1 through 3.2.11 have an authentication bypass vulnerability in the install/install handler. This flaw allows unauthenticated attackers to reinstall an already-installed instance without checking if the application is already installed. Exploitation enables overwriting configuration files, redirecting the application to attacker-controlled databases, creating administrator accounts, and executing commands via serialized gadget chains.
OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.
Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped.
This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.
The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.
Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter.
This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.
The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.