CVE-2026-94098

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...

CVE-2026-94098

A command injection vulnerability exists in the Netcore NBR200V2 router (firmware 1.3.241127.071246 ), specifically in the Firmware Upgrade CGI Endpoint at /www/cgi-bin/upgrade. An attacker can remotely exploit this by manipulating the QUERY_STRING argument, achieving high impact to confidentiali...

EUVD-2026-83810

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...

CVE-2026-88738: Unrestricted Upload of File with Dangerous Type

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be...

CVE-2026-88738

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be...

PT-2026-96017

Name of the Vulnerable Software and Affected Versions Netcore NBR200V2 version 1.3.241127.071246 Description Command injection is possible via remote manipulation of the QUERY STRING argument within the Firmware Upgrade CGI Endpoint. This issue occurs in the /www/cgi-bin/upgrade endpoint...

SUSE SLED15 / SLES15 Security Update : nghttp2 (SUSE-SU-2026:4029-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:4029-1 advisory. This update for nghttp2 fixes the following issue: - CVE-2026-58055: HTTP/1.1 Upgrade request can lead to HTTP request...

CVE-2026-88738

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be...

PT-2026-96297

Name of the Vulnerable Software and Affected Versions Jazzware RT1000 Edge webUI version 20.0.1 Description The upgrade package upload functionality allows an authenticated attacker with administrative privileges to upload server-side executable files. These files are stored in a web-accessible...

CVE-2026-94098: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This vulnerability affects unknown code of the file /www/cgi-bin/upgrade of the component Firmware Upgrade CGI Endpoint. Such manipulation of the argument QUERYSTRING leads to command injection. The attack can be executed...

CVE-2026-88738

The Jazzware RT1000 Edge webUI v. 20.0.1 is affected by an unrestricted file upload vulnerability within the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file, which is stored in a web-accessible location. This allows for rem...

CVE-2026-94083

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...

EUVD-2026-83638

Suricata before 8.0.7 has a DoH2 type confusion that can cause an invalid free, because cleanup code for the HTTP2 state is executed even though the actual state is HTTP1 when there is a DoH2 request with an HTTP1 to HTTP2 upgrade. This requires app-layer.protocols.doh2 to be enabled, which is th...

PT-2026-95902

Name of the Vulnerable Software and Affected Versions Suricata versions prior to 8.0.7 Description A type confusion exists in the handling of DoH2 DNS over HTTP/2 when a DoH2 request occurs during an HTTP1 to HTTP2 upgrade. This issue occurs because the cleanup code for the HTTP2 state is execute...

CVE-2026-84304 affecting package azcopy for versions less than 10.25.1-9

CVE-2026-84304 affecting package azcopy for versions less than 10.25.1-9. An upgraded version of the package is available that resolves this issue...

CVE-2026-73177

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

Sonatype Nexus Repository Manager 3 - Remote Code Execution

Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection id: CVE-2020-10199 info: name: Sonatype Nexus Repository Manager 3 - Remote Code Execution author: rootxharsh,iamnoooob,pdresearch severity: high description: Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection impact: |...

EUVD-2026-80700

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

CVE-2026-73177

Nozomi Networks Labs identified a CWE-345: Insufficient Verification of Data Authenticity vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS in firmware version V1.06.01. The device accepts firmware images through the authenticated web management interface without...

CVE-2026-73177

Nozomi Networks Labs identified a CWE-345 (Insufficient Verification of Data Authenticity) vulnerability in the firmware upgrade mechanism of the Advantech EKI-1242EIMS (firmware V1.06.01 ). The device accepts firmware images via its authenticated web management interface without performing any c...