541 matches found
CVE-2026-24169
NVIDIA UFM Enterprise contains a vulnerability in its plugin management API . An authenticated user with low privileges can inject code by sending a specially crafted API request. A successful exploit may lead to code execution , privilege escalation , and information disclosure . The CVSS 3.1 sc...
PT-2026-81382
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...
CVE-2026-24169: Improper Neutralization of Special Elements used in a Command
NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject code by sending a specially crafted API request. A successful exploit of this vulnerability might lead to code execution, escalation of privileges and...
CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...
CVE-2026-15706 Missing Authentication for Critical Function in Management API in Baylan Water Meters's BMS
Missing authentication for critical function vulnerability in Baylan Measuring Instruments Industry and Trade Inc. Baylan Smart Meter Management Application BMS allows Authentication Bypass. This issue affects Baylan Smart Meter Management Application BMS: before v1.1.10.142...
CVE-2026-15706
CVE-2026-15706 is a critical authentication bypass in the Management API of Baylan Smart Meter Management Application (BMS) by Baylan Measuring Instruments Industry and Trade Inc. The vulnerability stems from missing authentication for a critical function , allowing unauthenticated network access...
EUVD-2026-63165
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...
CVE-2026-76761
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...
CVE-2026-76761
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...
CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...
CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...
CVE-2026-76761
CVE-2026-76761 is an OS command injection vulnerability in chenhg5 cc-connect (up to version 1.4.1). The flaw resides in the shellExecCommand function within core/engine.go , part of the Management API component. An attacker can remotely manipulate the exec argument to inject and execute arbitrar...
CVE-2026-76761 chenhg5 cc-connect Management API engine.go shellExecCommand os command injection
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...
CVE-2026-59902 vulnerabilities
Vulnerabilities for packages: thingsboard, management-api-for-apache-cassandra-5.0, celeborn, trino, management-api-for-apache-cassandra-4.1, hadoop-fips, tez, pinot, tinkerpop, apache-hop-fips, pinot-fips, seata, management-api-for-apache-cassandra-4.0...
GHSA-2QJ4-MMR9-4V2F vulnerabilities
Vulnerabilities for packages: thingsboard, management-api-for-apache-cassandra-5.0, celeborn, trino, management-api-for-apache-cassandra-4.1, hadoop-fips, tez, pinot, tinkerpop, apache-hop-fips, pinot-fips, seata, management-api-for-apache-cassandra-4.0...
GHSA-2QJ4-MMR9-4V2F vulnerabilities
Vulnerabilities for packages: management-api-for-apache-cassandra-5.0, celeborn, thingsboard, trino, tez...
CVE-2026-59903 vulnerabilities
Vulnerabilities for packages: infinispan, thingsboard, wavefront-proxy, strimzi-kafka-operator, neo4j, opensearch, keycloak, celeborn, wildfly, apicurio-registry, logstash, druid, apache-pulsar, management-api-for-apache-cassandra-5.0, sonarqube, trino, flyway, apache-activemq-artemis, akhq, spar...
CVE-2026-76761: Improper Neutralization of Special Elements used in an OS Command
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...
PT-2026-78861
A vulnerability was identified in chenhg5 cc-connect up to 1.4.1. This affects the function shellExecCommand of the file core/engine.go of the component Management API. Such manipulation of the argument exec leads to os command injection. It is possible to launch the attack remotely. The exploit ...