FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
SharpEmu versions up to 0.0.3-release.3 are vulnerable due to missing authentication on its debugger frontend HTTP API running on localhost. This API lacks validation of critical headers and accepts cross-origin requests, allowing attackers with local network access to perform debugger operations, launch executables, and initiate outbound connections. The vulnerability is fixed in version 0.0.3-release.3-patch.1.
This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and origins loaded within the WebView component. A remote attacker could exploit this vulnerability by sending malicious web content to the affected WebView.
Successful exploitation of this vulnerability could allow the attacker to perform unauthorized interaction with application functionality, obtain live bearer authentication tokens and potentially impersonate the associated user and access vehicle related information and services.
CVE-2026-44265 is an improper input validation vulnerability in enspirit elo versions prior to 1.0.1. The vulnerability arises because Elo's programmatic AST API accepts arbitrary values from untyped sources and interpolates them into generated code without runtime syntax validation. This affects multiple fields such as int_literal/float_literal values, variable names, member access properties, object literal keys, datapath segments, lambda parameter names, and SQL let binding names. Exploitation can lead to arbitrary code execution in JavaScript, Ruby, and Python environments, as well as SQL injection in SQL targets. The issue is fixed in version 1.0.1.
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.
openEQUELLA versions prior to 2026.1 contain an OS command injection vulnerability in the system.execute() function of the scripting engine. This function executes supplied operating system commands without validation or an allow-list, allowing users with script creation or editing privileges to run arbitrary commands with the openEQUELLA service account's privileges. The issue is fixed in version 2026.1.
CVE-2026-118606 is a high-severity vulnerability in the Alpine iLX-F511 device framework service. It involves an exposed dangerous function that allows network-adjacent attackers to execute arbitrary code with root privileges without authentication. The vulnerability affects version 7.0.000 of the product and was publicly disclosed on October 28, 2026.
CVE-2026-118602 is a local privilege escalation vulnerability in the Alpine iLX-F511 device. It arises from an exposed dangerous method in the Fiv service, allowing an attacker with low-privileged code execution to escalate privileges to root. The vulnerability affects version 7.0.000 of the product and has a high severity score of 7.8.
CVE-2026-113775 is a high-severity vulnerability in Autodesk Fusion desktop application versions from 2705.1.30 up to but not including 2706.1.14. It involves an exposed dangerous function accessible via the TextCommands.LoadDll API command, which allows loading a dynamic library from an arbitrary path. A maliciously crafted dynamic library loaded this way can lead to arbitrary code execution within the context of the current process.
CVE-2026-70387 is a high-severity vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. The issue arises from an exposed dangerous method in the olc2 logging HAL that allows arbitrary command execution with elevated privileges due to insufficient authorization checks. The vulnerability enables processes with certain privileges to execute shell commands in a highly privileged SELinux context, potentially leading to full system compromise. Fixed versions are 15.0.0.2000 and 16.0.5.1200.
CVE-2026-70386 is a high-severity OS command injection vulnerability in OnePlus OxygenOS affecting versions from 15.0.0 before 15.0.0.2000 and from 16.0.0 before 16.0.5.1200. It allows any locally installed Android app, without declared permissions or user interaction beyond launch, to execute arbitrary shell commands as root in the dumpstate SELinux domain. This occurs due to lack of authorization on a binder interface and unsanitized input passed to a system command. Fixed versions are 15.0.0.2000 and 16.0.5.1200.
Markdown Preview Enhanced for Visual Studio Code versions prior to 0.8.30 contain a vulnerability where the webview message handler accepts attacker-controlled commands and arguments without validation. This allows JavaScript executing in the preview webview to invoke privileged extension commands, including file modification and code execution. Exploitation requires a separate JavaScript execution vector in the webview, but no additional authorization checks exist. The issue is fixed in version 0.8.30.
CVE-2026-109412 is a critical vulnerability in Ivanti Neurons Patch for Intune involving an exposed dangerous endpoint that allows a remote authenticated attacker to leak sensitive authentication information. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. No affected versions or patch information are provided in the available data.
A vulnerability in the Python expression evaluator asteval prior to version 1.0.9 allows an attacker to bypass sandbox restrictions. The issue arises because the default Interpreter with numpy enabled exposes a ctypes type and permits memory access via from_address. This enables an attacker-controlled expression to read or write arbitrary process memory, potentially crashing the host or disclosing secrets. The vulnerability is fixed in version 1.0.9.
SAP NetWeaver Visual Composer contains a vulnerability where insufficient authorization checks in certain portal functionality allow a low-privileged attacker to invoke internal operations on a preconfigured remote system. This can lead to a full compromise of the remote system, impacting confidentiality, integrity, and availability.
PayloadCMS versions before 3.90.0 and canary versions before 4.0.0-canary.34 contain a vulnerability in the optional Stripe REST proxy plugin. Authenticated users with access to this proxy can perform unintended Stripe operations. This issue is addressed in versions 3.90.0 and 4.0.0-canary.34.
Joyland.ai contains a critical vulnerability (CVE-2026-102667) that allows an attacker with shared network access to inject JavaScript into WebView content. This can lead to unauthorized access to clipboard data, arbitrary HTTP requests, and app-internal storage. If the app has previously granted permissions, the attacker could access sensitive device features such as the file system, camera, microphone, and GPS tracking.
Exposed Dangerous Method or Function in the
/WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows remote
authenticated users to execute arbitrary SQL commands via the sql parameter.
CVE-2026-86157 is a vulnerability in Progress Telerik Fiddler Everywhere before version 8.2.0 that exposes privileged inter-process communication (IPC) functionality. A local attacker with low privileges who can alter application launch parameters and convince a user to start the application may replace the UI or settings with attacker-controlled content. This can lead to disclosure of OAuth tokens, execution of local programs, or unauthorized changes to configuration files.