CVE-2026-44095

CVE-2026-44095 is described as a local privilege escalation affecting a script used for network configuration. A low-privileged local user can execute arbitrary commands as root, leading to full system compromise. The CVSS metrics indicate high impact on confidentiality, integrity, and availabili...

CVE-2026-44095

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

EUVD-2026-51030

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44095 Local Privilege Escalation via Network scripts

A privilege escalation vulnerability in a script used for network configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

EUVD-2026-51029

An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted...

CVE-2026-44094 Fallback to second RAUC slot with default credentials

An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted...

CVE-2026-44094

An unauthenticated remote attacker can enforce the system to fall back to a firmware partition with an insecure configuration including default credentials. This could allow the attacker to gain SSH access to the system as an unprivileged user "user-app". Charging could be interrupted...

CVE-2026-44094

The CVE-2026-44094 entry describes an unauthenticated remote attacker forcing a device to fall back to a firmware partition (second RAUC slot) with insecure configuration and default credentials, enabling SSH access as the unprivileged user "user-app". This could disrupt charging due to compromis...

CVE-2026-44093

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44093 Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

EUVD-2026-51028

A local privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44093

A local privilege escalation affecting the init-script for user-applications, specifically the /etc/init.d/user-applications startup script. The vulnerability allows a low-privilege local user to execute arbitrary commands as root, enabling full system compromise. This aligns with the NVD entry d...

CVE-2026-15252

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

EUVD-2026-51023

Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside...

CVE-2026-58066

Rocket.Chat SAML SSO prior to versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8 and 7.10.14 verify XML signatures but do not bind the validated signature to samlp:Response / saml:Assertion. An attacker could submit a wrapped document carrying forged identity attributes alongside a v...

CVE-2026-58046

Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel...

CVE-2026-15257

The CVE concerns the RegistrationMagic WordPress plugin, specifically versions before 6.0.9.4. The affected component is the front-end submission-editing action, where the plugin fails to perform authorization, ownership, or nonce checks. This exposes unauthenticated attackers to overwrite other ...

EUVD-2026-50998

The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submitting or removing the site's URLs from Google's index and...

EUVD-2026-50991

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...

CVE-2026-15235 Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action

The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account Subscriber and above to read the personal data, including name...