CVE-2026-79887

CVE-2026-79887 involves an Authentication Bypass in the Web Interface of AOS-8 that allows for Remote Command Execution (RCE) . While the provided documents do not specify the exact root cause or affected versions, the vulnerability is assigned a High severity (CVSS 3.1 score of 8.1) with impacts...

CVE-2026-79887 Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)

A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems...

CVE-2026-79887 Authentication Bypass in Web Interface of AOS-8 allows Remote Command Execution (RCE)

A vulnerability in the web interface of AOS-8 could allow an unauthenticated remote attacker to achieve remote code execution. Successful exploitation could lead to complete device control, enabling interception of network traffic and potential compromise of connected systems...

CVE-2026-114611

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint frontend/api-mdm.php verifies the signed enrollment-request plist with opensslpkcs7verify..., PKCS7NOVERIFY,...

CVE-2026-114611 OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint frontend/api-mdm.php verifies the signed enrollment-request plist with opensslpkcs7verify..., PKCS7NOVERIFY,...

EUVD-2026-108268

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint frontend/api-mdm.php verifies the signed enrollment-request plist with opensslpkcs7verify..., PKCS7NOVERIFY,...

CVE-2026-114611

The OCO-Server endpoint management application is vulnerable to a device identity disclosure and record hijack in versions prior to 1.2.3 . The Apple MDM enrollment endpoint at frontend/api-mdm.php uses openssl_pkcs7_verify with the PKCS7_NOVERIFY flag, which fails to validate the signer certific...

CVE-2026-114611 OCO-Server: MDM /profile endpoint accepts self-signed PKCS#7 signatures (PKCS7_NOVERIFY): device MDM identity (certificate + private key) disclosure and device-record hijack

OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior to 1.2.3,the Apple MDM enrollment endpoint frontend/api-mdm.php verifies the signed enrollment-request plist with opensslpkcs7verify..., PKCS7NOVERIFY,...

SUSE CVE-2026-98807

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

OESA-2026-4450 efivar security update

Some command line interface of the UEFI variables tools are offered by . Security Fixes: A flaw was found in libefiboot, a component of the efivar project. The device path node parser in libefiboot fails to validate that each node's Length field is at least 4 bytes, which is the minimum size for ...

InterSystems Corporation InterSystems IRIS for Health

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow an attacker to view transmitted data and use that data to log into the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize...

CVE-2026-114219

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information...

EUVD-2026-108002

NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-coded cryptographic key and decrypt login request contents, thereby obtaining users' plaintext account credentials and device information...

CVE-2026-98665

A flaw was found in the Linux kernel's MAX30102 sensor driver. This vulnerability allows a local user to cause a Denial of Service DoS through a system crash. The issue occurs when a device interrupt is triggered while no data buffer is active, causing the interrupt handler to access uninitialize...

PT-2026-121685

Name of the Vulnerable Software and Affected Versions Kiloview E3 NDI encoder affected versions not specified Description The ONVIF device service allows hostname, DNS, and NTP configuration write operations without authentication, ignoring the device's configured authentication settings. A remot...

PT-2026-121672

Name of the Vulnerable Software and Affected Versions E3 affected versions not specified Description The ONVIF device service responds to specific informational requests without requiring authentication. This allows a remote, unauthenticated party to retrieve detailed device identifiers and a lis...

PT-2026-121626

Name of the Vulnerable Software and Affected Versions AOS-8 affected versions not specified Description A flaw in the web interface allows an unauthenticated remote attacker to achieve remote code execution. This could result in full control of the device, allowing the attacker to intercept netwo...

KiloView E3 Firmware authorization issue vulnerability

Versions of the KiloView E3 firmware prior to 1.30 contain an authorization issue vulnerability. This vulnerability arises because the ONVIF device service accepts write operations for hostname, DNS, and NTP configurations without authentication. Remote attackers who lack authentication can modif...

PT-2026-121682

The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter accepted by its device naming endpoint, passing it unquoted into a shell command. An authenticated web user with access to this function can embed characters to execute arbitrary...

NewType Infortech NT OneAPP trust management issue vulnerability

NewType Infortech NT OneAPP versions 1.5.22 and earlier contain a trust management vulnerability. This vulnerability stems from hard-coded credentials; unauthenticated remote attackers can obtain these hard-coded encryption keys and decrypt login request contents, thereby gaining users’ plaintext...