Tactis NoviGest Desktop App authorization issue vulnerability

Versions of the Tactis NoviGest Desktop App prior to 8.0.0-300 contain an authorization issue vulnerability. This vulnerability stems from a lack of authentication for critical functions within the Java RMI service. Attackers with network access can invoke remote methods without authentication,...

CVE-2026-61567: WWBN AVideo-Encoder: AVideo is a video-sharing Platform

AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint view/videosListToLive.php accepts an attacker-named streamer in webSiteRootURL, calls Login::run in objects/Login.php, and trusts the returned JSON as session state. An unauthenticated remote attacker who can host an...

CVE-2026-59106 Unauthenticated RCE Vulnerability in WolfProt interface implementation

A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected...

CVE-2026-59106 Unauthenticated RCE Vulnerability in WolfProt interface implementation

A security vulnerability has been identified in the WolfProt interface implementation. Insufficient neutralization of user-controlled input could allow an unauthenticated attacker with network access to a vulnerable service to execute operating-system commands with the privileges of the affected...

CVE-2026-115189

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...

Wolfvision Cynap command injection vulnerability

Wolfvision Cynap has a command injection vulnerability stemming from improper handling of user-controlled input in its WolfProt interface implementation. This flaw may allow unauthenticated attackers with network access to execute operating system commands under the privileges of the affected...

OnPhase Forms authorization issue vulnerability

OnPhase Forms version 11.0.14 contains an authorization vulnerability stemming from a public registration form that allows authentication bypass. Unauthenticated remote attackers can manipulate registration parameters containing valid tenant names and existing user identifiers, thereby...

CVE-2026-109122

The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when configuring static routes via the web management API. An authenticated web user with permission to configure static routes can exploit this to execute arbitrary operating system...

CVE-2026-95710

An unauthenticated buffer overflow vulnerability exists in the underlying operating system of AOS-10 or AOS-8 and could allow an unauthenticated adjacent attacker to conduct a denial of service attack. Successful exploitation could allow an attacker to disrupt the availability of the affected...

CVE-2026-95706

Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying...

CVE-2026-95710

An unauthenticated adjacent buffer overflow vulnerability exists in AOS-10 or AOS-8 , which can lead to a Denial-of-Service (DoS) . Technical details regarding the specific component, root cause, and remediation are not provided in the available documents. Exploitation details are also not provid...

CVE-2026-95706 Authenticated Command Injection Vulnerabilities in AOS-8

Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying...

CVE-2026-95706

This CVE involves Authenticated Command Injection Vulnerabilities in AOS-8 . While the provided documents do not specify the exact root cause or affected components within AOS-8, the vulnerability allows for high-severity impact including high confidentiality, integrity, and availability. Technic...

CVE-2026-95705 Authenticated Command Injection Vulnerabilities in AOS-8

Command injection vulnerabilities in the affected interface of AOS-8 could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute commands with the privileges of the impacted mechanism on the underlying...

CVE-2026-95705

Technical details regarding CVE-2026-95705 are not publicly available in the provided documents. While one source title mentions Authenticated Command Injection Vulnerabilities in AOS-8 , no specific technical details, root causes, or remediation steps are provided. Monitor for updates.

CVE-2026-79849 Unauthenticated SQL Injection Vulnerabilities allow Remote Code Execution in AOS-8

Vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated remote attacker to conduct SQL injection attacks against an affected AOS-8 instance. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system...

Security Bulletin: Vulnerability in BIND (CVE-2025-13878) affects AIX/ VIOS.

Summary A remote attacker can send or trigger processing of malformed BRID/HHIT DNS resource records, causing the named daemon to terminate unexpectedly. Vulnerability Details CVEID:CVE-2025-13878 DESCRIPTION: Malformed BRID/HHIT records can cause named to terminate unexpectedly. This issue affec...

EUVD-2026-107653

In Splunk Enterprise versions below 10.4.4 and 10.2.8, a user who does not hold the "admin" or "power" Splunk roles could derive the PostgreSQL sidecar database superuser password and run arbitrary operating system commands as the user account running Splunk Enterprise on search head cluster...

HPE ArubaOS security vulnerabilities

HPE ArubaOS 8 has a security vulnerability stemming from the lack of input validation on affected interfaces. Privileged remote attackers can exploit this flaw to perform command injection attacks, potentially executing commands with elevated privileges on the underlying operating system...

HPE ArubaOS security vulnerabilities

A security vulnerability exists in HPE ArubaOS. It stems from a command injection flaw in affected interfaces, which may allow authenticated, highly privileged remote attackers to execute commands on the underlying operating system via relevant mechanisms...