EUVD-2026-81012

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63325 Redocly CLI: Arbitrary code execution via Arazzo `$faker` expression using `respect`

Redocly CLI makes OpenAPI validation, linting, and documentation workflows easier. Prior to version 2.33.0 of @redocly/respect-core and @redocly/cli, the respect command dynamically evaluates $faker runtime expressions in Arazzo descriptions. A crafted expression can traverse constructor,...

CVE-2026-63325

@redocly/respect-core and @redocly/cli (Redocly CLI) before version 2.33.0 contain an arbitrary code execution vulnerability in the respect command. The root cause is dynamic evaluation of $faker runtime expressions in Arazzo descriptions: a crafted expression can traverse constructor , prototype...

EUVD-2026-80815

Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests to internal networks and cloud...

CVE-2026-27559

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27563 Command Injection via GET in /api/datastorage/data

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80246

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561 Command Injection via GET in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80244

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561 Command Injection via GET in /api/iodd/config

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

CVE-2026-27561

CVE-2026-27561 is a command injection vulnerability in the /api/iodd/config endpoint. A high-privileged remote attacker can exploit it by sending a crafted GET request with admin credentials , enabling execution of commands with root privileges on the affected device. The CNA is CERT-VDE , which ...

CVE-2026-27559 Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

EUVD-2026-80242

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-27559

CVE-2026-27559 is a command injection vulnerability in the /api/status/data endpoint of a product managed by CERT VDE . A low-privileged remote attacker can send a crafted GET request with user credentials to execute commands with root privileges on the device. The assigned CVSS 3.1 score is 8.8 ...

CVE-2026-27559 Command Injection via GET in /api/status/data

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

CVE-2026-92299 @jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-92299: Missing Authorization

@jitsi/electron-sdk before 10.0.5 exposes getDesktopSources via contextBridge without requiring an active getDisplayMedia picker, allowing any script in the meeting page to enumerate screens and windows. Attackers can call the jitsi-screen-sharing-get-sources IPC route to retrieve desktop...

CVE-2026-27563: Improper Neutralization of Special Elements used in an OS Command

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...