CVE-2026-27550 Command Injection in Field_Shadow_Password Class

A low-privileged remote attacker can exploit a command injection vulnerability in the FieldShadowPassword class using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27549 Command Injection in /index.php/attached_devices_tab/do_upload

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27549

CVE-2026-27549 is a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint. A remote attacker with low-privileged operator credentials can inject commands that execute with root privileges on the device. The CVSS 3.1 score is 8.8 (HIGH) , reflecting network vect...

EUVD-2026-80232

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27548

CVE-2026-27548 is a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint. A low-privileged remote attacker with user or operator credentials can exploit it to execute commands with root privileges on the device, resulting in high impact on confidentiality, integrity,...

EUVD-2026-80231

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27547

A command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint allows a low-privileged remote attacker with valid user or operator credentials to execute arbitrary commands with root privileges on the device. The CERT-VDE assigns a CVSS 3.1 score of 8.8 (HIGH) with vector AV...

EUVD-2026-80230

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

CVE-2026-27547 Command Injection in /index.php/ajax/get_iodd_menu_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in spring boot (CVE-2026-40972)

Summary IBM Db2 Developer Extension is affected by vulnerability in spring boot CVE-2026-40972 Vulnerability Details CVEID:CVE-2026-40972 DESCRIPTION: An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. ...

CVE-2026-2441

CVE-2026-2441 — Use-After-Free в Chrome CSSFontFeatureValuesMap CVSS 8.8 Высокий | Активно эксплуатируется в дикой природе | RCE в рендере песочница Уязвимость use-after-free в движке Blink CSS браузера Google Chrome, позволяющая удалённому злоумышленнику выполнить произвольный код в песочнице...

CVE-2025-55182

📌 CVE-2025-55182 — React2Shell Критическое неаутентифицированное удаленное выполнение кода RCE в React Server Components 📖 Обзор CVE-2025-55182, неофициально названная React2Shell, представляет собой критическую уязвимость удаленного выполнения кода RCE, раскрытую 3 декабря 2025 года в React Serv...

CVE-2025-55182

CVE-2025-55182 - RCE des composants serveur React NOTE : Écrit par IA/Claude https://github.com/ejpir/CVE-2025-55182-bypass TL;DR CVE-2025-55182 est une vulnérabilité RCE critique dans le protocole Flight de React. La chaîne d'attaque combine traversée de chemin + injection de faux chunk + abus...

CVE-2026-33229

CVE-2026-33229 — XWiki RCE через обход песочницы Apache Velocity Уязвимость удалённого выполнения кода в XWiki Platform , которая позволяет аутентифицированному пользователю с правами на написание скриптов полностью обойти песочницу Apache Velocity — без необходимости использования Java Reflectio...

CVE-2025-69457

CVE-2025-69457 – Site Web de Tourisme Responsive 3.1 – Exécution de Code à Distance RCE Non Authentifiée – WriteUp CVE-2025-69457 – ExploitDB 50049...

java-deserialization-notes

Notes on Replicating Java Deserialization Vulnerabilities S...

CVE-2026-33154

Отчёт об уязвимости SSTI в Dynaconf Краткое описание Dynaconf уязвим к инъекции шаблонов на стороне сервера SSTI из-за небезопасной оценки шаблонов в резолвере @Jinja. Когда установлен пакет jinja2, Dynaconf вычисляет выражения шаблонов, встроенные в значения конфигурации, без песочницы sandboxed...

CVE-2025-55182-exploit

Exploit CVE-2025-55182 Ce dépôt contient un exploit simple pour CVE-2025-55182 , une vulnérabilité critique d'exécution de code à distance dans les React Server Components. Aperçu de la vulnérabilité CVE-2025-55182 est une vulnérabilité d'exécution de code à distance non authentifiée dans les Rea...

CVE-2025-55182

React2Shell Ultimate Scanner Scanner de vulnérabilité RCE RSC Next.js professionnel pour CVE-2025-55182 🎯 Aperçu React2Shell Ultimate est un scanner de vulnérabilités complet pour CVE-2025-55182 - une vulnérabilité critique d'exécution de code à distance RCE affectant les applications Next.js...

CVE-2026-92355

Octopus Server is affected by a path traversal flaw in the handling of non built-in external feeds. A user with low privileges (specifically, permission to modify non built-in external feeds) can exploit this to overwrite arbitrary files on the server. In some configurations, this may escalate to...