147 matches found
EUVD-2026-88213
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...
CVE-2026-12269
Zohocorp ManageEngine DDI Central version 6.2.0 (builds below 6201) is vulnerable to a Keepalived configuration injection vulnerability within the HA configuration workflow. An authenticated operator-level user can exploit this flaw to modify the Keepalived configuration, potentially leading to R...
CVE-2026-12269 Authenticated File Write to RCE via keepalived in DDI Central
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...
EUVD-2026-88209
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...
CVE-2026-12269 Authenticated File Write to RCE via keepalived in DDI Central
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...
PT-2026-99857
Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description An authenticated arbitrary file write issue exists during the HA Failover Config sync upload process, which can lead to remote code execution. Remote code execution is a type of attac...
PT-2026-99843
Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6.2.0 build 6201 Description A configuration injection flaw exists in the High Availability HA configuration workflow. This issue allows an authenticated user with operator-level privileges to modify...
PT-2026-99873
Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description Insufficient access control in the HA failover endpoint allows for destructive PostgreSQL database operations, which can lead to complete data destruction. Recommendations Update...
PT-2026-99849
Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description An issue exists that allows PowerShell command injection during the Windows DNS SPF/TXT record push process, which can lead to remote code execution. Recommendations Update ManageEngi...
PT-2026-99848
Name of the Vulnerable Software and Affected Versions ManageEngine DDI Central versions prior to 6201 Description Command injection is possible in the Windows DNS Query Resolution Policy name field, which can lead to remote code execution. Command injection is a flaw that allows an attacker to...
CVE-2026-12269: Unrestricted Upload of File with Dangerous Type
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI...
CVE-2026-12268: Improper Input Validation
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution...
CVE-2026-12267: Improper Input Validation
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution...
CVE-2026-12265: Improper Access Control
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...
CVE-2026-12264: Unrestricted Upload of File with Dangerous Type
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution...
azureml-evaluate-mlflow (>=0.0.35, <=0.0.36), ddi-fw (>=0.0.9, <=0.0.40) +3 more potentially affected by CVE-2026-64849 via mlflow (2.7.1)
mlflow PYPI version 2.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - azureml-evaluate-mlflow =0.0.35, =0.0.9, =0.2.0, =1.7.0, =0.4.5, =0.4.9rc1 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...
ddi-fw (>=0.0.41, <=0.0.97) potentially affected by CVE-2026-64849 via mlflow (2.16.1)
mlflow PYPI version 2.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - ddi-fw =0.0.41, =0.0.97 Source cves: CVE-2026-64849 Source advisory: OSV:PYSEC-2026-3687...
CVE-2026-12571
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover...