CVE-2026-80217

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands...

CVE-2026-80217

A hidden functionality issue in Liteon FF-RFI079I4 and FF-RFI078I4 devices allows a user who can log in via SSH and access enable mode to execute arbitrary OS commands , leading to high impact on confidentiality, integrity, and availability (CVSS 3.0: 8.8 HIGH ). The CISA SSVC rating indicates no...

CVE-2026-80217

Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands...

CVE-2026-77853

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

Security Bulletin: Multiple security vulnerabilities found and remediated in IBM webMethods Managed File Transfer

Summary IBM webMethods Managed File Transfer is vulnerable to multiple issues in third-party JavaScript libraries used by its web user interface. The Axios HTTP client is susceptible to prototype pollution attacks that could allow an attacker to intercept or hijack HTTP transport, and to stream...

Multiple vulnerabilities in Lite-On O-RU "FF-RFI079I4" and "FF-RFI078I4"

Overview O-RU "FF-RFI079I4" and "FF-RFI078I4" provided by LITE-ON Technology Corporation contain multiple vulnerabilities listed below. OS Command Injection CWE-78 - CVE-2026-77853 Hidden Functionality CWE-912 - CVE-2026-80217 Yuto Aono, Yutaro Osako, and Shunsuke Saruwatari of The University of...

Cisco Secure Email Gateway Flaw Exploited in the Wild, Enables Root Command Execution

Cisco has warned that a new critical vulnerability impacting AsyncOS Software for Cisco Secure Email Gateway has come under active exploitation in the wild. The vulnerability, tracked as CVE-2026-76461 , carries a CVSS score of 9.8 out of a maximum of 10.0. It has been described as a case of...

PT-2026-92465

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-89026: Use of Hard-coded Cryptographic Key

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers c...

PT-2026-91900

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in FF-RFI079I4 and FF-RFI078I4. A user who can log in to the product's M-Plane NETCONF may execute arbitrary OS commands...

PT-2026-92120

Name of the Vulnerable Software and Affected Versions Yonyou U8 CRM affected versions not specified Description An unauthenticated SQL injection exists in the 'fillbacksettingedit.php' endpoint. By using the DontCheckLogin=1 parameter, authentication is bypassed, and the id parameter is...

PT-2026-92443

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description Buffer overflow issues exist in an API endpoint that could allow an unauthenticated remote attacker to execute arbitrary commands on the underlying operatin...

PT-2026-92450

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Gateways affected versions not specified Description A flaw in a component allows an authenticated remote attacker to execute arbitrary commands by providing specially crafted input. Successful exploitation ca...

CVE-2026-76691: Buffer Copy without Checking Size of Input

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker to execute arbitrary commands as a privileged user on the underlying operating system...

CVE-2026-76705: Buffer Copy without Checking Size of Input

A buffer overflow vulnerability exists in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways. Successful exploitation could allow an authenticated remote attacker with Admin privilege to execute arbitrary commands on the underlying operating system...

CVE-2026-76683: Buffer Copy without Checking Size of Input

Buffer overflow vulnerabilities exist in the API endpoint of HPE Networking EdgeConnect SD-WAN Gateways that could allow an unauthenticated remote attacker to run arbitrary commands on the underlying host if certain preconditions outside of the attacker's control are met. Successful exploitation...

CVE-2026-12101: Authentication Bypass by Alternate Name

IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation of user supplied requests...

PT-2026-91921

Name of the Vulnerable Software and Affected Versions WSO2 Integrator MI VS Code extension affected versions not specified Description The WSO2 Integrator MI VS Code extension fails to properly sanitize or validate user-supplied input when processing Micro Integrator projects opened from untruste...

PT-2026-92447

Name of the Vulnerable Software and Affected Versions HPE Networking EdgeConnect SD-WAN Orchestrator affected versions not specified Description A flaw in the API endpoint allows a low-privilege authenticated remote attacker to escalate privileges. This could lead to the execution of arbitrary...

VulnCheck KEV: CVE-2024-58385

Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCheckLogin=1 parameter bypasses authentication and the id parameter is incorporated into SQL queries without sanitization. Attackers can exploit this flaw to...