CVE-2026-86102: Improper Neutralization of Special Elements used in an OS Command

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system...

PT-2026-102308

Name of the Vulnerable Software and Affected Versions deepseek-ai deepseek-harness versions prior to 0.1.5-rc.3 Description A security issue exists in the dsh component within the file packages/e2b/e2b/src/index.ts. The manipulation of the E2B API KEY argument leads to a security decision based o...

PT-2026-102401

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A remote command injection issue exists in the /api/ZRnetwork/set passwd endpoint. This occurs when the password1 argument is manipulated, allowing an attacker to execute arbitrary commands on the...

PT-2026-102358

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description An issue exists in the USB Device Management API within the file usr/lib/lua/luci/controller/api/zrUsb.lua. A remote attacker can perform command injection by manipulating the path argument passed...

PT-2026-102391

Name of the Vulnerable Software and Affected Versions Ziroom ZHOME A0101 version 1.0.1.0 Description A remote command injection issue exists in the /api/ZRnetwork/firstLogin endpoint. This occurs when the firstLogin argument is manipulated, allowing an attacker to execute arbitrary commands on th...

CVE-2026-101260: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-75600: Improper Neutralization of Special Elements used in an OS Command

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator...

CVE-2026-101187: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function popusbdevice of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes command injection. The attack is...

CVE-2026-96740: Use of Externally-Controlled Input to Select Classes or Code

A flaw was found in the StreamsHub Console for Apache Kafka. Tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without filtering security-sensitive keys, allowing a Console CR author to set config.providers and...

CVE-2026-101004: Missing Authentication for Critical Function

A security vulnerability has been detected in notionnext-org NotionNext up to 4.10.10. Affected by this issue is the function cleanCache of the file pages/api/cache.js of the component Authentication Guard. The manipulation of the argument token leads to missing authentication. The attack may be...

CVE-2026-82379: Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to replay it and gain the victim's AtomPub authority, because the authentication does not enforce nonce uniqueness or timestamp freshness. Only installations th...

CVE-2026-89300: Missing Authorization

The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated users to insert arbitrary data into its own database table, as well as to make the site send templated verification emails to arbitrary email addresses. The...

CVE-2026-101006: Incorrect Authorization

A flaw has been found in Frappe HR up to 16.15.0. This vulnerability affects the function getexpenseclaims/getshiftrequests/getattendancerequests of the file hrms/api/init.py of the component Permission Validation. This manipulation of the argument employee causes incorrect authorization. Remote...

CVE-2026-82930: Missing Authentication for Critical Function

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information, and send raw control commands to...

CVE-2026-12342: Improper Input Validation

This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due to improper input validation of submitted web service API content...

PT-2026-99771

Name of the Vulnerable Software and Affected Versions Frappe HR versions prior to 16.15.0 Description An incorrect authorization issue exists within the Permission Validation component. The flaw allows remote exploitation by manipulating the employee argument in the get expense claims, get shift...

PT-2026-99920

Name of the Vulnerable Software and Affected Versions IdentityIQ affected versions not specified Description An unauthenticated user can achieve remote code execution on the server due to improper input validation of content submitted to web service API endpoints. Recommendations At the moment,...

PT-2026-99963

Name of the Vulnerable Software and Affected Versions StreamsHub Console for Apache Kafka affected versions not specified Description A flaw exists where tenant-supplied Kafka client properties from the Console custom resource are copied into the console-api AdminClient configuration without...

PT-2026-99866

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...

PT-2026-102325

Name of the Vulnerable Software and Affected Versions moxygen versions prior to commit 004123dd24c3 Description The MoQSession::dataStreamReadLoop function continues to use a stream read handle after a FIN a signal indicating the end of a data stream has been read. This action invalidates the...