CVE-2026-27547 Command Injection in /index.php/ajax/get_iodd_menu_info

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93355

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93357

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93353

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93341

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with user or operator credentials can execute commands with root privileges on the device. This is possible through a command...

CVE-2026-73172: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the edgserver management service of Advantech EKI-1242EIMS in firmware version V1.06.01 that allows a remote unauthenticated attacker to execute...

CVE-2026-73176: Improper Neutralization of Special Elements used in an OS Command

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

PT-2026-93356

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A high-privileged remote attacker can execute commands with root privileges on the device via a command injection flaw. This occurs when a crafted GET request is...

PT-2026-93352

A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...

PT-2026-93342

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached devices tab/do upload endpoint using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93340

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get iodd menu info endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93354

A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...

PT-2026-93347

A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save iodd parameters endpoint using operator credentials allowing execution of commands with root privileges on the device...

PT-2026-93351

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A low-privileged remote attacker with operator credentials can execute commands with root privileges on the device. This is possible through a command injection...

CVE-2026-68070

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-68070 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

EUVD-2026-79949

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

CVE-2026-68070 Missing Authentication for Critical Function in Digital Watchdog VMAX DVR and NVR Product Lineups

The affected products are missing authentication for a critical function, which could allow an attacker to run as root and pass received bytes directly to a system command...

EUVD-2026-79216

A vulnerability exists in a component of the HPE Networking EdgeConnect SD-WAN Gateways that may allow for arbitrary command execution. An authenticated remote attacker could exploit this vulnerability by providing a specially crafted input to the affected component. Successful exploitation could...

Important: Red Hat Security Advisory: leapp-repository security update

An update for leapp-repository is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabili...