PT-2026-93694

Name of the Vulnerable Software and Affected Versions WNC T-Mobile 5G Box IDU router versions prior to 1.1.0.651412 Description An authenticated attacker can execute arbitrary commands on the shell and gain root access to the system due to a command injection flaw. The issue occurs in the ping...

CVE-2026-73164: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73163: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

PT-2026-94000

Name of the Vulnerable Software and Affected Versions Cisco Secure FMC Software affected versions not specified Description An issue exists in the remote diagnostics debugger of Cisco Secure FMC Software where an error occurs when verifying the privilege level of a user invoking remote diagnostic...

CVE-2026-20283: Improper Neutralization of Special Elements used in an OS Command

A vulnerability in the IPsec Open API endpoint of Cisco ISE could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. This vulnerability is due to insufficient validation of user-supplied input in IPsec Open API calls. An attacker could exploit...

CVE-2026-20323: Improper Certificate Validation

A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure FMC Software and Cisco Secure FTD Software could allow an unauthenticated, adjacent attacker to impersonate the peer device and obtain access at the level of the manager role, which is equivalent to root. This...

CVE-2026-73167: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-68950

The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable...

CVE-2026-68950

CVE-2026-68950 affects Digital Watchdog VMAX DVR and NVR product lineups. The root cause is hard-coded credentials , which allow an attacker to run the ftpd service as root , granting remote root file access where FTP is reachable. The vulnerability is rated HIGH severity (CVSS 3.1: 8.8, CVSS 4.0...

CVE-2026-68950 Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use hard-coded credentials, which could allow an attacker to run the ftpd service as root, providing remote root file access where FTP is reachable...

CVE-2026-68070

Digital Watchdog VMAX DVR and NVR product lineups are affected by a missing authentication flaw for a critical function, allowing an adjacent-network attacker—requiring no privileges—to execute code as root by passing received bytes directly to a system command (command injection). CISA rates it ...

CVE-2026-66890

Digital Watchdog VMAX DVR and NVR devices are affected by a hard-coded credentials vulnerability that allows an attacker with adjacent-network access to gain remote file access with root privileges when the device's FTP service is reachable. The CISA-assigned CVSS 3.1 score is 9.6 (CRITICAL) , wi...

CVE-2026-66890 Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable...

CVE-2026-66890 Use of Hard-coded Credentials in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable...

EUVD-2026-79947

The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable...

CVE-2026-89040

Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...

CVE-2026-76690

A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected component. Successful exploitation could...

CVE-2026-89040

Tencent Mass Service Engine in Cluster (MSEC) is affected by a path traversal vulnerability that allows a remote, unauthenticated attacker to send a crafted POST request containing ../, gaining root access on the target device. An attacker who uploads a webshell can then execute arbitrary code as...

EUVD-2026-79672

Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...

CVE-2026-89040 Tencent Mass Service Engine in Cluster (MSEC) path traversal

Tencent Mass Service Engine in Cluster MSEC allows a remote, unauthenticated attacker to send a crafted POST request including ../ and gain root access on the target device. An attacker who uploads a webshell can execute arbitrary code as root...