CVE-2026-85040 ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040 ZhongBangKeJi CRMEB Custom Scheduled Task Feature save eval os command injection

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-85040

ZhongBangKeJi CRMEB (up to 6.0.0 ) is vulnerable to OS command injection in the Custom Scheduled Task feature. The eval function in /adminapi/system/crontab/save unsafely processes the customCode argument, allowing remote attackers to inject operating-system commands. The vendor documents this as...

EUVD-2026-70314

A weakness has been identified in ZhongBangKeJi CRMEB up to 6.0.0. Affected by this vulnerability is the function eval of the file /adminapi/system/crontab/save of the component Custom Scheduled Task Feature. This manipulation of the argument customCode causes os command injection. It is possible...

CVE-2026-76178: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notification. A user with administrator privileges can input malicious HTML content which is subsequently stored and displayed without proper sanitisation when other...

CVE-2026-85437: Out-of-bounds Write

MOOS-IvP through 24.8.1 contains multiple buffer overflow vulnerabilities in IvP function string decoders that trust attacker-controlled length fields without validation. Attackers can craft malicious encoded strings with mismatched declared and actual field lengths to overflow heap and stack...

The vulnerability of the cdns_resume() function in the drivers/usb/cdns3/core.c file of the Linux operating system’s device driver framework allows a hacker to induce a service failure.

The vulnerability of the cdnsresume function in the drivers/usb/cdns3/core.c file of the Linux device driver framework relates to access to an uninitialized pointer. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the vfio_group_ioctl_set_container() function in the drivers/vfio/group.c module of the VFIO device driver for the Linux operating system allows a attacker to cause a service failure.

The vulnerability of the vfiogroupioctlsetcontainer function in the drivers/vfio/group.c module of the VFIO device driver for the Linux operating system is related to the use of pointers. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the ucan_probe() function in the drivers/net/can/usb/ucan.c module of the Linux network device driver allows a hacker to cause a service failure.

The vulnerability of the ucanprobe function in the drivers/net/can/usb/ucan.c module of the Linux network device driver framework is related to the failure to release resources after their useful life has expired. Exploiting this vulnerability could allow an attacker to cause service failures...

CVE-2026-85172: Server-Side Request Forgery (SSRF)

n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and Function nodes. The validation logic checks the uri property for SSRF safety while the underlying HTTP client uses the url property when both are present,...

The vulnerability of the reg() function in the lib/grammar.js module, a module for defining methods to access and manage XML documents, allows attackers to bypass existing security mechanisms.

The vulnerability of the reg function in the lib/grammar.js module, which is used for accessing and managing XML documents, is related to errors in processing XML requests. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms remotely...

PT-2026-85312

Name of the Vulnerable Software and Affected Versions Azure AI Language affected versions not specified Description Missing authentication for a critical function allows an unauthorized attacker to elevate privileges over a network without requiring any user interaction. Recommendations At the...

The vulnerability of the disk_release() function in the block/genhd.c module allows for a kernel-level block-level support in the Linux operating system, enabling a hacker to cause a service failure.

The vulnerability of the diskrelease function in the block/genhd.c module related to Linux’s kernel-level block support involves the failure to release resources after their useful lifespan has ended. Exploiting this vulnerability could allow an attacker to cause service failures...

Unity Linux 20.1070-8ae / 20.1070e Security Update: kernel (UTSA-2026-105436)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-105436 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: Fix return type of netcpndostartxmit With clang's kernel control flow integrit...

The vulnerability of the adf_probe() function in the drivers/crypto/intel/qat/qat_6xxx/adf_drv.c file of the Linux operating system’s cryptographic accelerator driver allows a hacker to cause a service failure.

The vulnerability of the adfprobe function in the drivers/crypto/intel/qat/qat6xxx/adfdrv.c file of the Linux kernel’s cryptographic accelerator driver is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability could allow an attacker to cause a system...

CVE-2026-84888 RightNow-AI OpenFang tool_runner.rs shell_exec memory allocation

A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shellexec of the file crates/openfang-runtime/src/toolrunner.rs. This manipulation causes uncontrolled memory allocation. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-84886

A resource consumption vulnerability affects the OCR HTTP API component of simular-ai Agent-S versions up to 0.3.2. The flaw resides in the ImageData function within the file gui_agents/s1/utils/ocr_server.py, where manipulation of the img_bytes argument can exhaust system resources. The attack i...

net/mail: golang: net/mail: Denial of Service via pathological email address parsing

A flaw was found in the net/mail package within the Go standard library. A remote attacker could provide specially crafted, pathological email addresses. When these malformed email addresses are parsed by the consumePhrase function, it can lead to excessive resource consumption due to quadratic...

CVE-2026-84852 Reader Tools PDF Reader App File ActSplashNew.handleDeeplink path traversal

A security vulnerability has been detected in Reader Tools PDF Reader App 98.8 on Android. The affected element is the function ActSplashNew.handleDeeplink of the component File Handler. The manipulation of the argument displayname leads to path traversal. An attack has to be approached locally...

net/mail: golang: Go net/mail: Denial of Service via crafted email inputs

A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...