VulnCheck KEV: CVE-2026-120203

ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users to execute shell commands through mockjs templates. Attackers can store a template via MockController::add with escaped parentheses that mockjs evaluates with eval, then trigger...

CVE-2026-57154: opnsense core: OPNsense is a FreeBSD based firewall and routing platform

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to...

EUVD-2026-115631

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges...

CVE-2026-119740

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

CVE-2026-119737

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...

CVE-2026-119740 Nexbox A95X Amlogic S905X UART Unauthenticated Console Access

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

CVE-2026-119740

The Nexbox A95X TV boxes built on the Amlogic S905X platform are vulnerable to a multi-stage attack leading to full root-level compromise. Physical attackers can access an unauthenticated console via an internal UART header on the PCB using a USB-to-TTL adapter to obtain an interactive shell as u...

EUVD-2026-115401

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB that allows physical attackers to obtain an interactive shell as uid 2000 system without any credentials. Attackers with physical access and a USB-to-TTL...

CVE-2026-119737 Amlogic pppoe_wrapper Command Injection via AF_UNIX Socket

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...

EUVD-2026-115546

The pppoewrapper vendor daemon from the Amlogic Android SDK, as shipped on Nexbox A95X Amlogic S905/S905X TV boxes, contains a command injection vulnerability that allows local attackers to execute arbitrary commands as root by sending crafted messages to a world-writable AFUNIX datagram socket a...

CVE-2026-119737

The pppoe_wrapper vendor daemon in the Amlogic Android SDK , specifically on Nexbox A95X (Amlogic S905/S905X) TV boxes, is vulnerable to a command injection flaw. A local attacker can execute arbitrary commands as root by sending crafted messages to a world-writable AF_UNIX datagram socket at /de...

ROOT-APP-NPM-CVE-2026-26278 CVE-2026-26278 in fast-xml-parser - Patched by Root

Root has patched CVE-2026-26278 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-41650 CVE-2026-41650 in fast-xml-parser - Patched by Root

Root has patched CVE-2026-41650 in the fast-xml-parser package for Root:npm. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48710 CVE-2026-48710 in starlette - Patched by Root

Root has patched CVE-2026-48710 in the starlette package for Root:PyPI. Multiple fixed versions available...

CVE-2026-77880

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77878

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77877

Control Web Panel CWP before webpanelversion 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

CVE-2026-104080

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

CVE-2026-104080

Control Web Panel (CWP) versions before webpanel_version 1.30 are vulnerable to an OS command injection in the loopback API /valid_token/ route. The vulnerability exists because the application fails to validate the user parameter, allowing unauthenticated attackers to inject shell metacharacters...

EUVD-2026-115249

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...