CVE-2026-27550 Command Injection in Field_Shadow_Password Class

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27550

CVE-2026-27550 is a command injection vulnerability in the Field_Shadow_Password class, as reported by CERT-VDE (CNA: [email protected]). A low-privileged remote attacker can exploit this flaw using operator credentials to execute commands with root privileges on the affected device, resulting in...

EUVD-2026-80232

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27549

CVE-2026-27549 is a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint. A remote attacker with low-privileged operator credentials can inject commands that execute with root privileges on the device. The CVSS 3.1 score is 8.8 (HIGH) , reflecting network vect...

CVE-2026-27549 Command Injection in /index.php/attached_devices_tab/do_upload

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27549 Command Injection in /index.php/attached_devices_tab/do_upload

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27548 Command Injection in /index.php/ajax/get_iodd_port_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27548

CVE-2026-27548 is a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker with user or operator credentials can exploit it to execute commands with root privileges on the device, resulting in high impact on confidentiality, integrity,...

CVE-2026-27547 Command Injection in /index.php/ajax/get_iodd_menu_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27547

A command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint allows a low-privileged remote attacker with valid user or operator credentials to execute arbitrary commands with root privileges on the device. The CERT-VDE assigns a CVSS 3.1 score of 8.8 (HIGH) with vector AV...

CVE-2026-81326

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...

CVE-2026-81326

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...

CVE-2026-81326

CVE-2026-81326 affects QND by QualitySoft, a product whose client is installed on Windows PCs. The root cause is a hard-coded cryptographic key , which may allow a local attacker with logged-in access to the client machine to obtain administrator credentials , including an ID and password. The vu...

EUVD-2026-80226

QND uses a hard-coded cryptographic key, which may allow a local attacker who is logged in to a Windows PC where the affected product's client is installed to obtain administrator credentials, including an ID and password...

EUVD-2026-80043

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in modvpnremote/plan.json, pptpdusershow.cgi, pptpclientconfigshow.cgi, and l2tpdusershow.cgi. Attackers can leverage these components to obtain PPTP and L2TP VPN credentials...

EUVD-2026-80062

Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the userpassshow.cgi component. Low-privilege attackers can exploit this flaw via uiconfig2.xml and misc.js to disclose router credentials...

EUVD-2026-80060

Netcore NR255-V firmware version 1.5.130703 contains a sensitive information disclosure vulnerability in the ddnswanlistshow.cgi endpoint and related DDNSsetcgi, IGDGetCgiHandler, and IGDCgiCall components. Attackers who reach this CGI handler can obtain plaintext DDNS credentials, exposing...

PT-2026-93342

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached devices tab/do upload endpoint using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93414

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.10.0 Description The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, rather than restricting it to the client...