CVE-2026-114355

The DJI CrystalSky ZS600C firmware (versions v0.3.9.7 through v0.6.6.9 ) on Android contains an OS command injection vulnerability in the root-privileged hardware_monitor helper. The root cause is that the helper reads data from the Android log (logcat) and passes it directly to a shell eval func...

CVE-2026-114355 DJI CrystalSky ZS600C hardware_monitor evaluates attacker-controlled log data as root

OS command injection in the root-privileged 'hardwaremonitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log logcat, which the helper reads and...

EUVD-2026-108985

OS command injection in the root-privileged 'hardwaremonitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log logcat, which the helper reads and...

EUVD-2026-108984

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without...

CVE-2026-93640 Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without...

CVE-2026-93640

The optional dnscache package in Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21 contains a local privilege escalation vulnerability. The root cause is an unrestricted zmunbound sudo configuration that allows the Unix zimbra account to execute arbitrary arguments. Attackers can prov...

CVE-2026-93640 Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration

A local privilege escalation vulnerability in the optional dnscache package of Zimbra Collaboration Suite ZCS allows the Unix zimbra account to access files with root privileges. The passwordless sudo policy permits arbitrary arguments to zmunbound, whose wrapper forwards them to Unbound without...

EUVD-2026-108982

Missing authorization in the native binder service 'android.dji.server' transaction code 1018 in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplie...

CVE-2026-114354 DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root

Missing authorization in the native binder service 'android.dji.server' transaction code 1018 in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplie...

CVE-2026-114354

The DJI CrystalSky ZS600C firmware (v0.3.9.7 through v0.6.6.9) on Android is vulnerable to a command injection vulnerability due to missing authorization in the native binder service 'android.dji.server' (transaction code 1018). A local application with no permissions can execute arbitrary OS com...

CVE-2026-114354 DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root

Missing authorization in the native binder service 'android.dji.server' transaction code 1018 in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplie...

EUVD-2026-108981

A local privilege escalation vulnerability in the Zimbra Collaboration Suite ZCS MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. ...

CVE-2026-50057 Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions

A local privilege escalation vulnerability in the Zimbra Collaboration Suite ZCS MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. ...

CVE-2026-50057

A local privilege escalation vulnerability exists in the Zimbra Collaboration Suite (ZCS) MTA package, specifically affecting versions 10.1.16 and 10.1.21 . The root cause is an unrestricted sudo policy that allows the zimbra account to execute Postfix administration commands as root without argu...

CVE-2026-50057 Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions

A local privilege escalation vulnerability in the Zimbra Collaboration Suite ZCS MTA package allows the Unix zimbra account to execute arbitrary commands as root. The installed sudo policy permits passwordless root execution of Postfix administration commands without restricting their arguments. ...

CVE-2026-114353

The DJI CrystalSky ZS600C (firmware v0.3.9.7 through v0.6.6.9 ) on Android contains a hidden backdoor within the root-privileged 'assistant' daemon . A physically-present attacker with USB access can execute arbitrary OS commands as root by sending the hard-coded magic string dji26656677 to the U...

CVE-2026-114353 DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

EUVD-2026-108980

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

CVE-2026-114353 DJI CrystalSky ZS600C USB-gadget backdoor allows root command execution

Hidden functionality undocumented backdoor in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string...

CVE-2026-50056

A local privilege escalation vulnerability exists in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) versions 10.1.16 and 10.1.21. The root cause is an argument injection flaw where the passwordless sudo interface accepts unrestricted JVM arguments. An attacker with local command e...