Search vulnerabilities

Expected end of text, found '/' (at char 28), (line:1, col:29)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,877

CVE-2026-105622

Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel

Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Zenitel
Products
Zenitel Connect
CVE-2026-105624

Zenitel Connect login allows account-lockout denial of service

The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zenitel
Products
Zenitel Connect
CVE-2026-105623

Zenitel Connect web interface serves production JavaScript source maps without authentication

The web interface in Zenitel Connect before 1.11.0 serves production JavaScript source maps without authentication, which allows remote attackers to obtain the complete front-end source code, including API usage and internal client logic, via requests for the source map files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zenitel
Products
Zenitel Connect
CVE-2026-95379

Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root

Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter. This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Zenitel
Products
Vsff6 Vsff8 Vsff8mn and 2 more
CVE-2026-95613

Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim

The pREST database REST API in Zenitel Connect firmware before 1.11.0 signs and verifies JWTs with the platform CA private key, which is stored on a data volume shared between containers, and sets the PostgreSQL session role from the unvalidated sub claim of each request while connected to the database as the "postgres" superuser, which allows local attackers who can read the platform CA private key from the container filesystem to execute database operations as the PostgreSQL superuser, including reading the master encryption key and password hashes, via a forged JWT with sub=postgres sent to the pREST API.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Zenitel
Products
Zenitel Connect
CVE-2026-95378

Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root

Path traversal in the certificate upload endpoint (/api/certificate/upload) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to write arbitrary files as root via a crafted filename parameter in a multipart upload request when the type field is set to any value other than https_certificate. In that case, both path validation and certificate content validation are skipped. This can be escalated to arbitrary code execution as root, for example by overwriting startup scripts or planting SSH keys.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Zenitel
Products
Vsff6 Vsff8 Vsff8mn and 2 more
CVE-2026-95615

Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audio_messages endpoint.

CVSS 4.0 · 8.7 High EPSS 1.2% KEV · Not listed
Vendors
Zenitel
Products
Zenitel Connect
CVE-2026-95614

Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container

The host configuration watcher in Zenitel Connect before 1.11.0 applies a rsyslog configuration file written to a data volume that is shared with the hiatus application container, which allows local attackers with write access to the hiatus container filesystem to execute arbitrary OS commands as root on the host operating system via a crafted rsyslog configuration file.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Zenitel
Products
Zenitel Connect
CVE-2026-95377

OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning

OS command injection in the TFTP provisioning module of Zenitel EdgeAudioClient before 9.6.3.0, and 10.x before 10.1.3.0, on VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices allows unauthenticated adjacent attackers to execute arbitrary commands as root via a crafted DHCP option 66 (TFTP Server Name) value supplied by a rogue DHCP server on the same network segment. The DHCP-supplied value is passed to a shell without sanitization. Devices using DHCP, the default configuration, are affected on every boot and lease renewal. The same injection is also reachable via the config_update_tftp_server and sw_update_tftp_server configuration fields by an attacker able to modify the device configuration.

CVSS 4.0 · 9.4 Critical EPSS 1.2% KEV · Not listed
Vendors
Zenitel
Products
Vsff6 Vsff8 Vsff8mn and 2 more
CVE-2026-129131

Gameyfin before 2.6.2 Missing Authorization in Hilla Endpoints

Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass login-required mode by calling Hilla endpoints annotated with @AnonymousAllowed. Attackers can POST to synchronous endpoint methods such as GameEndpoint.sync, which LiveSubscriptionSecurity never checks, to retrieve game catalog metadata, libraries, platforms, plugins and game requests.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gameyfin
Products
Gameyfin
CVE-2026-129130

agent-device 0.21.36 Local File Disclosure via file:// Navigation in Open Command

agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated remote callers to read daemon-host files by opening file:// URLs. Attackers can send an open command with a file:// target through /rpc, then issue snapshot to read any plaintext file readable by the daemon account.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Callstack
Products
Agent-device
CVE-2026-129126

C-Kermit before 11.1.515 Heap Buffer Overflow via putsrv() Packet Decoding

C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious peers to write past the srvcmd buffer by sending crafted packets. Attackers can use Kermit repeat-count compression in server command, GET, or file-header packets to write attacker-chosen bytes beyond the heap buffer on servers or receiving instances.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Openkermit
Products
C-kermit
CVE-2026-129125

C-Kermit 6.0.192 before 11.1.515 Command Execution via REMOTE QUERY

C-Kermit 6.0.192 before 11.1.515 contains a remote code execution vulnerability that allows Kermit clients to run shell commands on servers with host commands disabled by abusing REMOTE QUERY evaluation. Attackers can send a REMOTE QUERY invoking the command function, or define a macro via REMOTE ASSIGN and call execute to reach RUN, bypassing the nopush restriction and DISABLE HOST.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Openkermit
Products
C-kermit
CVE-2026-129124

C-Kermit before 11.1.515 OS Command Injection via REMOTE WHO and REMOTE SPACE

C-Kermit before 11.1.515 contains an OS command injection vulnerability that allows remote clients to execute shell commands by supplying unquoted arguments to REMOTE WHO or REMOTE SPACE. Attackers can append shell metacharacters to arguments passed through WHOCMD or SPACM2 to syscmd(), executing commands on the server host even when DISABLE HOST is set.

CVSS 4.0 · 9.2 Critical EPSS 1.3% KEV · Not listed
Vendors
Openkermit
Products
C-kermit
CVE-2026-129123

C-Kermit 8.0.200 before 11.1.515 FTP Client Buffer Overflow via PBSZ and ADAT Replies

C-Kermit 8.0.200 before 11.1.515 contains a buffer overflow vulnerability in getreply() in ckcftp.c that allows malicious FTP servers to overwrite client memory by sending overlong security replies. Attackers controlling or intercepting an FTP server can send long PBSZ replies after AUTH TLS, or long ADAT replies in GSSAPI, Kerberos 4, and SRP builds, overflowing the static reply_buf with attacker-controlled bytes.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Openkermit
Products
C-kermit
CVE-2026-129122

C-Kermit 6.0.192 before 11.1.515 Buffer Overflow via Telnet NEW-ENVIRON Negotiation

C-Kermit 6.0.192 before 11.1.515 contains a buffer overflow vulnerability in tn_snenv() in ckctel.c that allows malicious Telnet servers to corrupt client memory via crafted NEW-ENVIRON SEND subnegotiation. Malicious or machine-in-the-middle servers can send oversized variable names before authentication, overflowing a 16-byte stack buffer and a miscomputed heap buffer to corrupt stack and heap memory.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Openkermit
Products
C-kermit
CVE-2026-129121

C-Kermit 8.0.200 before 11.1.515 Path Traversal via FTP MGET /RECURSIVE

C-Kermit 8.0.200 before 11.1.515 contains a path traversal vulnerability in doftpget() in ckcftp.c that allows malicious FTP servers to write files outside the intended directory. Attackers can return absolute paths, tilde names, or dot-dot components in NLST or MLSD listings during MGET /RECURSIVE to overwrite files like .bashrc, leading to code execution.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Openkermit
Products
C-kermit
CVE-2026-129120

C-Kermit 11.0.506 before 11.1.515 RECEIVE CONFIRM Bypass via Recursive GET

C-Kermit 11.0.506 before 11.1.515 contains a RECEIVE CONFIRM bypass vulnerability that allows malicious Kermit servers to write unrequested files without prompting by abusing recursive GET root computation in ckcfns.c. Attackers can send files such as .ssh/authorized_keys or shell startup files under the current directory, which rq_under_root() accepts silently, enabling persistent access or code execution.

CVSS 4.0 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Openkermit
Products
C-kermit
CVE-2026-129119

C-Kermit 6.0.192 before 11.1.515 File Collision Protection Bypass via RESEND

C-Kermit from 6.0.192 before 11.1.515 contains a file collision protection bypass that allows malicious senders to append data to existing files by marking transfers as RESEND. The gattr() function in ckcfn3.c clears the REJECT discard flag and switches to APPEND without a RECEIVE CONFIRM prompt, letting attackers modify files such as shell startup files.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Openkermit
Products
C-kermit
CVE-2026-129118

C-Kermit 8.0.200 before 11.1.515 Improper Certificate Hostname Matching via dNSName_cmp

C-Kermit 8.0.200 before 11.1.515 contains an improper certificate hostname validation vulnerability that allows attackers to impersonate hosts by abusing wildcard matching in dNSName_cmp() in ck_ssl.c. Attackers holding a trusted certificate with over-matching names containing asterisks, question marks, brackets, or empty labels can intercept credentials and data over Telnet, FTP, and HTTP TLS connections.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Openkermit
Products
C-kermit