CVE-2026-126818 is a vulnerability in the MongoDB Ruby Driver where automatic field-level encryption is not applied to certain fields when using class inheritance in the data model. This results in sensitive data being stored in plaintext in the database without any error or warning. An attacker with read-only access to the database collections but no access to the encryption key store could read these sensitive values.
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.
Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.
CVE-2026-123635 is a resource management vulnerability in elixir-grpc grpc_server versions from 1.0.0 up to but not including 1.1.0. It allows a client to stall all subsequent calls on a shared HTTP/2 connection by sending calls that the server refuses while their DATA frames are still in flight. This causes the connection's flow-control window to be depleted, blocking further request bodies on that connection until deadlines expire. Other connections remain unaffected. The issue is fixed in version 1.1.0.
CVE-2026-126817 is a vulnerability in the MongoDB Ruby Driver's Mongoid ODM automatic client-side encryption schema generation. When multiple models map onto the same storage location, values intended for encryption may be stored in cleartext without any error or warning. This allows a user with read-only database access, but no encryption keys, to read sensitive data in clear form.
The web interface in Zenitel Connect before 1.11.0 loads an integration iframe without sandboxing or origin restrictions, which allows remote attackers to present phishing content to authenticated users via a crafted frame source.
Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows authenticated administrators to run root commands by importing a malicious OpenVPN client configuration. Attackers can include tls-verify or ipchange directives, which the incomplete denylist does not filter, to execute commands as root when the router connects to an attacker-controlled VPN endpoint.
Cudy TR3000 versions before 2.5.42 have a remote code execution vulnerability that allows authenticated administrators to execute commands as root by uploading specially crafted OpenVPN private or tls-auth keys. The vulnerability arises from improper encoding or escaping of output, enabling attackers to inject directives that bypass security restrictions and execute arbitrary code with root privileges.
Cudy TR3000 devices prior to version 2.5.42 have a mass assignment vulnerability in the vpn.set_conf App RPC method. This flaw allows authenticated administrators to inject arbitrary OpenVPN server options, including enabling malicious commands executed as root via the openvpn-hotplug wrapper. The vulnerability is fixed in version 2.5.42.
CVE-2026-129102 is a command injection vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device versions before 2.5.42. Authenticated administrators can exploit improper neutralization of CRLF sequences in the IPsec keyexchange field of the vpn.set_conf RPC method to execute commands as root. This is achieved by injecting newlines to append a second leftupdown directive to ipsec.conf, which StrongSwan's updown plugin executes with root privileges when an attacker-controlled peer establishes the CHILD_SA.
Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by injecting newlines into reboot_time. Attackers can submit a reboot_time value followed by a newline and crontab line, which /etc/init.d/autoreboot writes to the root crontab for crond to run.
CVE-2026-129104 is a vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device before version 2.5.42. It involves improper neutralization of CRLF sequences allowing authenticated administrators to inject dnsmasq configuration directives via the net.set_dhcp leasetime field. This can lead to DNS manipulation or service disruption on LAN clients. The issue is fixed in version 2.5.42.
CVE-2026-129105 is a high-severity vulnerability in Shenzhen Cudy Technology Co., Ltd's TR3000 device before version 2.5.42. It involves improper neutralization of CRLF sequences, allowing authenticated administrators to inject arbitrary pppd options via crafted L2TP credentials. This can lead to unauthorized modification of pppd options files and potentially affect the root pppd process. The issue is fixed in version 2.5.42.
The login flow in Zenitel Connect before 1.11.0 returns different error responses depending on whether a submitted username exists, which allows remote attackers to enumerate valid user accounts via crafted login requests.
The npm package @ewms/el-bootstrap contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised device. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
A missing authorization vulnerability exists in CleverReach® WP plugin versions up to 1.5.26. This flaw allows attackers with limited privileges to exploit incorrectly configured access control security levels, potentially leading to partial confidentiality, integrity, and availability impacts.
Eclipse BaSyx Go Components versions up to and including 1.1.2 contain an authorization bypass vulnerability in ABAC-enabled deployments of the Submodel Repository and the AAS Environment. This flaw allows an authenticated user with read access to a single Submodel Element to retrieve all elements of that Submodel via the list route, exposing unauthorized data. The issue is resolved in version 1.1.3.
The CCC Attestation SIG attested-tls-poc project contains a time-of-check time-of-use (TOCTOU) vulnerability in its attestation process. The vulnerability arises because evidence is only appraised once during the TLS handshake, with no re-attestation after the handshake completes. This allows attackers with local access to the attesting endpoint to modify workload code, data, configuration, or attached devices such as GPUs, while peers continue to trust the original attestation evidence.
xschem versions 2.9.9 through 3.4.7 contain an out-of-bounds read vulnerability in the read_xschem_file() function within src/save.c. This flaw occurs when processing embedded-symbol records that lack a preceding instance, allowing crafted schematic files starting with a "[" record to cause memory reads below the instance array and crash the application.
An OS command injection vulnerability (CWE-78) exists in the network-configuration handling of the management service (uavmonitor_usbv1) on the 1300 communications board of DJI AeroScope Mobile (TP703) firmware 03.00.00.26 and board firmware versions 02.00.07.12 through 02.00.08.40. This flaw allows an unauthenticated attacker on the local network to execute arbitrary commands as root by sending crafted configuration values to TCP port 16000. The injected commands persist across reboots. The affected products are no longer supported and no firmware fixes are available.