CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised REQUEST_METHOD.
For a REQUEST_METHOD such as OPTIONS, CGI falls through to its offline debugging mode, which is on by default, and builds the parameters and path_info from the process's command line arguments.
Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces.
This issue affects Costifier: through 2026-10-16. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Perforce P4 Search container images prior to 2026.4.2 enable an unauthenticated Java debug interface. An attacker with network access to this interface can execute arbitrary code as the P4 Search service account, potentially leading to compromise of the connected P4 Server.
CVE-2026-102628 is a critical vulnerability in the Eummena Cadmos LTI application caused by Laravel debug mode being enabled in a publicly accessible environment. This misconfiguration allows an unauthenticated attacker to trigger an unhandled exception via a GET request, exposing the entire server environment including sensitive .env configuration variables in plaintext. The issue was fixed on or before 2026-09-02.
CVE-2026-13313 is a high-severity vulnerability in certain ASUS router models involving active debug code. It allows a remote authenticated user to bypass security controls via a crafted HTTP request, enabling the Telnet service. This leads to arbitrary command execution with root privileges on the affected router, potentially impacting other devices connected to it. The vulnerability is identified as CWE-489 (Active Debug Code). No specific affected versions or patch information are provided in the available data.
In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally provide elevated system access.
Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Active Debug Code vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, Protection mechanism bypass, and Unauthorized access.
CVE-2026-84486 is a vulnerability in Red Hat Ansible Automation Platform 2.6 for RHEL 9 where debug endpoints intended for development are accessible in production builds without authentication. These endpoints allow unauthenticated attackers to repeatedly acquire a cluster-wide scheduler advisory lock, causing legitimate scheduler runs to be skipped and stalling job dispatch for all tenants. Additionally, the debug root view discloses the list of debug endpoints to unauthenticated users.
CVE-2026-50228 is a vulnerability in Acer NitroSense V5 (up to version 5.2.63) where the Electron DevTools endpoint is exposed on localhost TCP port 9993 with Chromium remote debugging enabled. This allows an unauthenticated local attacker to execute JavaScript in the privileged application context, leading to arbitrary code execution.
CVE-2026-6485 is a high-severity vulnerability in Insyde Software's InsydeH2O UEFI BIOS. It involves active debug code in the embedded shell that can be exploited to bypass Secure Boot protections using shell commands or startup scripts. This vulnerability has a CVSS score of 8.2, indicating a significant risk to confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.
CVE-2026-77545 is a critical vulnerability in Ubiquiti Inc's UniFi OS Server involving active debug code. An attacker with network access and low privileges could exploit this flaw under certain conditions to escalate their privileges within the affected UniFi OS devices or instances. The vulnerability has a high CVSS score of 9.0, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-66787 is a vulnerability in the lighthouse component of Red Hat Advanced Cluster Management for Kubernetes. It involves insufficient validation of advertised IP addresses within EndpointSlice objects. A compromised spoke cluster can exploit this flaw to redirect legitimate service traffic to malicious endpoints, enabling transparent Man-in-the-Middle (MITM) attacks on cross-cluster communications. This can lead to unauthorized information disclosure and data manipulation. The vulnerability has a high severity with a CVSS score of 8.7. Red Hat has addressed this issue in version 2.17 with security fixes and updated container images.
When Calico's shared debug server is enabled (disabled by default), the Calico kube-controllers and Goldmane components bind their Go pprof debug listener to 0.0.0.0 without authentication. Any pod with network reachability to the listener can retrieve the process heap, goroutine stacks (including function arguments), and command-line arguments. Depending on the process's in-memory state, the heap may contain sensitive material. The debug listener is opt-in but is unsafe when enabled because it offers no authentication and no safe localhost-only binding option.
This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware.
An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism.
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code with elevated privileges on the targeted device.
Allwinner H616 TV Box TV98 has ADB enabled and exposed to the network on production. An attacker could request for ADB authorization and gain root level privileges if the victim allows access.
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application contains a vulnerability in its firmware update mechanism's signature validation process. This could allow an attacker to install malicious firmware, leading to persistent code execution and system compromise.
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V26.20), SICORE Base system (All versions < V26.20.0). The affected application includes a debugging interface that is accessible through HTTP endpoints. This could allow an authenticated attacker to disrupt the system by crashing the web process causing denial of service conditions.
JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the /debug/pprof/cmdline endpoint to obtain the process command line containing metadata engine connection strings with database credentials, granting full read/write access to filesystem metadata, while other pprof handlers leak internal state and profiling handlers enable denial of service.
The ai_cmd utility executes with full root permissions. It pipes socket inputs directly to popen(), paving the way for unauthenticated users to execute arbitrary root commands.
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, when Algernon is invoked with a single file path instead of a directory, singleFileMode is set to true and debugMode is forcibly enabled.debugMode activates the PrettyError renderer, which on any Lua or template error response dumps the absolute path of the file that errored, complete byte contents of that file, and exception or parser error text. This response is served with HTTP 200 OK to whoever sent the request that triggered the error. Any client able to reach the server and able to provoke a runtime error in the served script obtains the full server-side source of that script and of any sibling Lua data file consulted during the request. This vulnerability is fixed in 1.17.7.