CVE-2026-90464: Improper Link Resolution Before File Access

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only Device Monitor privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel...

Joseph Huckaby xyOps permission and access control issue vulnerability

Versions of Joseph Huckaby xyOps prior to 0.9.121 contain a security vulnerability. This vulnerability arises because non-administrator users possessing the createevents and runevents privileges, or API keys, can inject top-level uid and gid fields via /api/app/createevent and /api/app/updateeven...

EUVD-2026-111070

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

SUSE SLES16 Security Update : ca-certificates-mozilla (SUSE-SU-2026:24361-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:24361-1 advisory. This update for ca-certificates-mozilla fixes the following issue: Updated to 2.92 state bsc1286261 Removed: - emSign ECC Root CA - C3 -...

PT-2026-126641

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

PT-2026-126626

A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who can impersonate or intercept traffic to the configured log server to execute arbitrary code with root privileges by presenting a specially crafted certificate...

PT-2026-127216

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

PT-2026-126640

An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attacker with at least read-only Device Monitor privileges and access to the management CLI to create, truncate, or overwrite arbitrary files and modify kernel...

Sunhillo SureLine command injection vulnerability

Versions prior to Sunhillo SureLine 9.1.5 contain a command injection vulnerability. This vulnerability stems from OS command injection in the networkDiag.cgi endpoint. Authenticated remote attackers can inject shell metacharacters into the ipAddr or dnsAddr parameters, thereby bypassing characte...

TeamViewer Full Client race condition vulnerability

TeamViewer Full Client and Host versions prior to 15.83, version 14.7.0 prior to 14.7.48868, and version 13.2.0 prior to 13.2.154007 contain a race condition vulnerability. This vulnerability stems from a TOCTOU race condition involving check time and usage time within privileged helper routines,...

CVE-2026-78845

Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light Bulb 3.30.17 are vulnerable to Remote Code Execution RCE via UPnP root description parsing...

WatchGuard Fireware OS buffer error vulnerability

Buffer error vulnerabilities exist in WatchGuard Fireware OS versions prior to 2025.1 through 2026.4, versions 12.0 through 12.12.4, and versions 12.0 through 12.5.22 T15/T35 platforms. These vulnerabilities stem from a stack buffer overflow in the logging service. Network-neighboring attackers c...

TeamViewer Full Client permission and access control issue vulnerability

Versions prior to TeamViewer Full Client 15.83, TeamViewer Host 15.83, and TeamViewer Remote Management Monitoring 26.10.1 contain a privilege escalation and access control vulnerability stemming from improper IPC communication access controls. This vulnerability may allow locally authenticated...

CVE-2026-112351: Improper Neutralization of Special Elements used in an OS Command

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

CVE-2026-90465: Authentication Bypass by Spoofing

A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall management actions as root by sending a specially crafted request...

CVE-2026-93864: Improper Limitation of a Pathname to a Restricted Directory

A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged system process to overwrite arbitrary files with root privileges, and to tamper with firewall IP set data, by planting a crafted file system object and...

PT-2026-127148

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...

TP-Link RE305 command injection vulnerability

The TP-Link RE305 V3 running firmware versions prior to 1.1.8 Build 20260921 Rel. 42853 contain a command injection vulnerability. This flaw arises because the TDDP v2 service utilizes a fixed and predictable encryption key. As a result, unauthenticated attackers within the same local network can...

PT-2026-127149

An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the...

PT-2026-127215

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...