CVE-2026-76943

CVE-2026-76943 affects the Xiiaozet LK100W (LK100Wt) device, which contains an authentication weakness in an administrative service that allows an attacker to bypass access controls and obtain command execution capabilities. Successful exploitation could lead to unauthorized interaction with priv...

CVE-2026-76943 Xiiaozet LK100W Authentication Bypass Using an Alternate Path or Channel

Xiiaozet LK100Wt contains an authentication weakness within an administrative service that may allow an attacker to bypass intended access controls and obtain command execution capabilities. Successful exploitation could allow unauthorized interaction with privileged functionality and may lead to...

MAL-2026-14584 Malicious code in flyteplugins-redis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-redis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14583 Malicious code in flyteplugins-nsight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-nsight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14581 Malicious code in flyteplugins-agento11y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-agento11y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-echo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14582 Malicious code in flyteplugins-echo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e40fe85c793ea410384a1c17184e6f7fe08f039a19599b9fb9933cda4078b85c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

CVE-2026-78037

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface . An authenticated attacker can execute arbitrary operating system commands with elevated privileges, potentially leading to unauthorized access to sensitive information or complete device compromise ...

CVE-2026-78037 Xiiaozet LK100W OS Command Injection

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-78037 Xiiaozet LK100W OS Command Injection

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-76060

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

EUVD-2026-67311

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-76060

An authenticated OS command injection vulnerability in ZoneMinder's event export functionality allows any user with View Events permission to execute arbitrary commands on the server. The exportFile HTTP parameter is passed unsanitized into a shell command executed via PHP's exec() , enabling ful...

CVE-2026-76060 OS Command Injection in PayRange API

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec, allowing any authenticated user with View Events permission to execute arbitrary operati...

CVE-2026-37003

Agno up to and including 2.5.8 is vulnerable to Remote Code Execution RCE via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec, runpy.runpath, and subprocess.run. An unauthenticated attacker can exploi...