CVE-2026-58255 Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with createevents and runevents privileges can inject top-level uid and gid fields through /api/app/createevent or /api/app/updateevent. In lib/api.js,...

samsung_tizen_tv_root

Samsung Tizen 9 TV Root — Research Toolkit Unofficial security research on a 2024 Samsung Neo QLED running Tizen 9. No sdb, no developer mode, no firmware flashing: the TV is rooted from its own browser, and the root is made persistent through a stock on-boot service app. | ---|--- Test unit| 202...

CVE-2026-112350

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

CVE-2026-112351

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

CVE-2026-112352

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-112352

Sunhillo SureLine versions prior to 9.1.5 are vulnerable to an authentication bypass due to a lack of validation and integrity protection on session cookies. An unauthenticated remote attacker can impersonate any user with an active session by forging a cookie containing a cleartext username, suc...

EUVD-2026-111360

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-112352 Sunhillo SureLine Authentication Bypass via Session Cookie

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-112352 Sunhillo SureLine Authentication Bypass via Session Cookie

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection...

CVE-2026-112351 Sunhillo SureLine OS Command Injection via networkDiag.cgi

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

EUVD-2026-111359

Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that allows an authenticated remote attacker with any web account to execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. Attackers...

CVE-2026-112351

Sunhillo SureLine versions prior to 9.1.5 are vulnerable to an OS command injection vulnerability in the networkDiag.cgi endpoint. An authenticated remote attacker with any web account can execute arbitrary commands as root by injecting shell metacharacters into the ipAddr or dnsAddr parameters. ...

EUVD-2026-111361

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

CVE-2026-112350 Sunhillo SureLine Path Traversal via radarUpdater.cgi

Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows unauthenticated remote attackers to read arbitrary files with root privileges due to missing authentication checks and insufficient sanitization of the filename parameter. Attackers...

CVE-2026-112350

Sunhillo SureLine versions prior to 9.1.5 are vulnerable to a path traversal flaw in the radarUpdater.cgi endpoint. The root cause is a lack of authentication checks and insufficient sanitization of the filename parameter, allowing unauthenticated remote attackers to read arbitrary files with roo...

CVE-2026-102814

An authentication weakness exists in the TP-Link TDDP v2 service of TP-Link RE305 V3. TDDP v2 uses a fixed and derivable cryptographic key, which may allow an unauthenticated attacker on the same local network to forge protocol packets and access privileged TDDP operations, including functionalit...

CVE-2026-102815

An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the...

SUSE CVE-2026-99063

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-102815

A local command injection vulnerability exists in the tmpServer service of the TP-Link RE305 V3 . The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process can submit a crafted request to the TDDPv1 service to execu...

EUVD-2026-111274

An operating-system command injection vulnerability exists in the tmpServer service of TP-Link RE305 V3. The service runs with root privileges and listens on the local loopback interface. A local attacker with access to a low-privileged process on the device may submit a crafted request to the...