CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS

Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...

CVE-2026-15706

CVE-2026-15706 is a critical authentication bypass in the Management API of Baylan Smart Meter Management Application (BMS) by Baylan Measuring Instruments Industry and Trade Inc. The vulnerability stems from missing authentication for a critical function , allowing unauthenticated network access...

EUVD-2026-63165

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761

CVE-2026-76761 is an OS command injection vulnerability in chenhg5 cc-connect (up to version 1.4.1). The flaw resides in the shellExecCommand function within core/engine.go , part of the Management API component. An attacker can remotely manipulate the exec argument to inject and execute arbitrar...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: thingsboard, apache-hop-fips, tinkerpop, management-api-for-apache-cassandra-4.1, management-api-for-apache-cassandra-4.0, hadoop-fips, trino, pinot, management-api-for-apache-cassandra-5.0, tez, pinot-fips, seata, celeborn...

CVE-2026-59902 vulnerabilities

Vulnerabilities for packages: thingsboard, apache-hop-fips, tinkerpop, management-api-for-apache-cassandra-4.1, management-api-for-apache-cassandra-4.0, hadoop-fips, trino, pinot, management-api-for-apache-cassandra-5.0, tez, pinot-fips, seata, celeborn...

GHSA-2QJ4-MMR9-4V2F vulnerabilities

Vulnerabilities for packages: trino, tez, thingsboard, management-api-for-apache-cassandra-5.0, celeborn...

CVE-2026-59903 vulnerabilities

Vulnerabilities for packages: apache-pulsar, flyway, logstash, druid, keycloak, thingsboard, management-api-for-apache-cassandra-5.0, sonarqube, celeborn, wildfly, zipkin, wavefront-proxy, apicurio-registry, akhq, kserve-modelmesh, trino, apache-activemq-artemis, tez, infinispan, opensearch,...

PT-2026-78861

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-76761: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: thingsboard, apache-hop-fips, tinkerpop, hadoop-fips, management-api-for-apache-cassandra-5.0, tez, apache-hop, seata...

CVE-2026-73507 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, tez, thingsboard...

CVE-2026-72655 Improperly Controlled Modification of Dynamically-Determined Object Attributes in Kibana Leading to Unauthorized Data Modification

Improperly Controlled Modification of Dynamically-Determined Object Attributes CWE-915 in the case management functionality of Elastic Security in Kibana can lead to unauthorized modification of case data by an authenticated user who has not been granted case editing privileges, via Manipulating...

CVE-2026-55986 Email Management API Bypasses ManageCredentials Feature Restrictions

Email Management API Bypasses ManageCredentials Feature Restrictions...

CVE-2026-55986

The Gitea Git repository management platform is vulnerable to an access control deficiency in its Email Management API . This flaw allows an attacker to bypass restrictions within the ManageCredentials feature, potentially leading to privilege escalation remotely. While specific affected versions...