Threat database

CVE-2026-16740 is a critical vulnerability in TR7 Cyber Defense Inc.'s TR7 ASP product on both virtual and physical appliances. It involves missing authentication for a critical function, which allows an attacker to perform OS command injection. The affected versions are from 1.0.40.236 up to but not including 1.0.1554.2331, and from 1.6.42.239 up to but not including 1.6.1554.2331. The vulnerability has a CVSS 3.1 score of 9.8, indicating a high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. No patch or remediation information is provided in the input data.

CVE-2026-16741 is a critical OS command injection vulnerability in TR7 Cyber Defense Inc.'s TR7 ASP product on both virtual and physical appliances. It affects versions from 1.0.40.236 up to but not including 1.0.1554.2331, and from 1.6.42.239 up to but not including 1.6.1554.2331. The vulnerability allows an attacker to execute arbitrary operating system commands due to improper neutralization of special elements in OS commands.

Missing authentication for critical function vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Authentication Abuse. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. WAF-ASP allows Stored XSS. This issue affects WAF-ASP: from v1.0.324.900 before v1.4.0.117.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TR7 Cyber ​​Defense Inc. Web Application Firewall allows DOM-Based XSS. This issue affects Web Application Firewall: from v1.0.42.239 before v1.4.0.117.

URL Redirection to Untrusted Site ('Open Redirect') vulnerability in TR7 Cyber ​​Defense Inc. Web Application Firewall allows Phishing. This issue affects Web Application Firewall: from 4.30 before v1.4.0.117.