CVE-2026-83772 Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

EUVD-2026-68984

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

CVE-2026-83772 Cobham SATCOM VSAT7090 Maritime Satellite Router JSON Parsing mail-report.sh c_set_reports_decode command injection

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

UBUNTU-CVE-2026-19032

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

PT-2026-84152

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

CVE-2026-83772: Improper Neutralization of Special Elements used in a Command

A vulnerability was detected in Cobham SATCOM VSAT7090 Maritime Satellite Router up to 20260704. This issue affects the function csetreportsdecode of the file mail-report.sh of the component JSON Parsing. The manipulation of the argument sender/recipients results in command injection. It is...

CVE-2026-84189: Improper Neutralization of Input During Web Page Generation

LibreNMS through 26.4.0 renders JSON fields name, ip, model, author, commit message returned by the admin-configurable Oxidized integration URL oxidized.url into the device showconfig page without applying htmlspecialchars. An administrator who points the Oxidized URL at an attacker-controlled...

MAL-2026-15819 Malicious code in @mrlegendbot/baileys (npm)

@mrlegendbot/baileys is a fork of the WhatsApp Web library @whiskeysockets/baileys that silently makes the victim account follow attacker-chosen WhatsApp newsletter channels. lib/Socket/newsletter.js adds a startAutoFeatures function line 230 that is scheduled with setTimeout =...

Payload CMS 3.72.0 SQL Injection

Payload CMS version 3.72.0 suffers from a remote blind SQL injection vulnerability. Exploit Title: Payload CMS 3.72.0 - Blind SQL Injection Google Dork: N/A Date: 2026-08-01 Exploit Author: cardosource Vendor Homepage: https://payloadcms.com/ Software Link: https://github.com/payloadcms/payload...

CVE-2024-7952: Use of Hard-coded Credentials

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

PT-2026-84119

Name of the Vulnerable Software and Affected Versions Cobham SATCOM VSAT7090 Maritime Satellite Router versions prior to 20260704 Description Command injection is possible via remote attack in the JSON Parsing component. The issue exists within the c set reports decode function of the...

PT-2026-84369

A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can be reached without authentication. If exploited, a threat actor could view customer data...

CVE-2026-19032: Use of Externally-Controlled Input to Select Classes or Code

jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize, a string bound from untrusted JSON is passed to new URIvalue and then to Path.ofuri. When that throws...

PT-2026-84365

Name of the Vulnerable Software and Affected Versions llama.cpp versions prior to b5694 Description Uncontrolled recursion occurs in the common/json-schema-to-grammar.cpp file, which can lead to a denial of service. Uncontrolled recursion is a condition where a function calls itself without a...

CVE-2026-52130: Uncontrolled Recursion

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...

CVE-2026-52130

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...

iperf3 security update

3.9-17.1 - Resolves: RHEL-236176 - Add JSON value checks for getparameters CVE-2026-71217...

CVE-2026-52130

llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service...

iperf3 security update

3.17.1-6.1 - Fix JSON value bounds checks in getparameters and iperfparsearguments CVE-2026-71217 - Resolves: RHEL-236170...

RockyLinux 9 : iperf3 (RLSA-2026:61389)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:61389 advisory. iperf3: iperf3 server accepts unbounded peer-controlled JSON parameters enabling remote denial of service via resource exhaustion CVE-2026-71217 Tenable has...