CVE-2026-86551

Wi-Fi MAC Address Obtainment by Non-privileged Program Vulnerability in ZTE Z80Ultra (NX741J) product

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Zte

Products

Nx741j

CVE-2026-85497

CareCam CM2507 Use of Password Hash With Insufficient Computational Effort

CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance to offline cracking. An attacker who obtains the firmware image or password database could recover the associated credential, which may also be reusable across other devices running the same firmware.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Carecam

Products

Hmt.cm2507 Firmware

CVE-2026-85478

CareCam CM2507 Missing Authentication for Critical Function

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or modification of boot configuration, firmware data, and software loaded by the device.

CVSS 4.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Carecam

Products

Hmt.cm2507 Firmware

CVE-2026-84298

Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Hatchet-dev

Products

Hatchet

CVE-2026-82672

Unvalidated chunk-size line tail in Mint HTTP/1 client enables response smuggling against strict intermediaries on pooled connections

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on a pooled connection, enabling response-queue poisoning against subsequent requests that share the connection. Mint.HTTP1.Parse.chunk_size/1 in lib/mint/http1/parse.ex stops at the first non-hexadecimal byte of a chunked response's chunk-size line and returns the remainder unexamined. Mint.HTTP1.decode_body/5 in lib/mint/http1.ex then discards every byte up to the CRLF with Parse.ignore_until_crlf/1, so the accepted grammar is a run of hex digits followed by arbitrary bytes, where RFC 9112 permits only a ;-introduced chunk extension. Lines such as 5ZZZZZ and 5 9 are accepted as chunk size 5, and 0ZZZZ is accepted as the terminating chunk that ends the message body. An RFC-strict intermediary rejects such a line while Mint accepts it, so the two disagree on chunk boundaries and on where the response ends. This issue affects mint: from 0.1.0 before 1.10.1.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Elixir-mint

Products

Mint

CVE-2026-81669

IBM Guardium Data Protection is affected by multiple vulnerabilities.

IBM Guardium Data Protection 12.2 is vulnerable to a command injection vulnerability in the create csr wildcard CLI command. An authenticated privileged CLI user can inject arbitrary shell commands through the alias input, resulting in command execution with root privileges.

CVSS 3.1 · 7.2 High EPSS 1.3% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-79920

Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin construct a pip package specification from unvalidated name and version fields, and the task worker invokes pip while running as root. A low-privileged user can therefore select or manipulate a package installed with root privileges and can install, remove, or upgrade plugins without administrative permission, resulting in root code execution and full host compromise. This issue is fixed in version 2.2.16.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Ajenti

Products

Ajenti

CVE-2026-77972

safeurl validated address is not bound to the request, allowing DNS rebinding

Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach internal network destinations that validation rejected. Validation returns a verdict and not the address it approved, so the HTTP clients the library ships receive the original hostname and resolve it a second time when the request is made. An attacker who controls the authoritative DNS for a name can answer the first lookup with a permitted address and the second with a blocked one, and the request then reaches a destination validation never approved. The same window opens without an attacker whenever a name legitimately resolves to different addresses across lookups, such as short record lifetimes or rotation between several addresses. This issue affects safeurl: from 0.1.0 onward.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Slab

Products

Safeurl

CVE-2026-77866

SSRF protection bypass in safeurl via IPv6 addresses and unresolvable hosts

Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network destinations the library is configured to block. Only IPv4 addresses are matched against the reserved ranges and the blocklist. Every other address is treated as matching nothing, so a destination that is rejected in its IPv4 form is accepted when written as an IPv6 address, IPv6 entries in the blocklist never match, and a host that resolves to no IPv4 address is accepted regardless of where it points. Deployments that rely on the allowlist instead are unaffected, because there an unmatched address is rejected. This issue affects safeurl: from 0.1.0 onward.

CVSS 4.0 · 9 Critical EPSS < 1% KEV · Not listed

Vendors

Slab

Products

Safeurl

CVE-2026-77166

Inadequate Input Validation in Emoji Update Endpoint Causes Layout Breakage

The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items.

CVSS 3.0 · 2.4 Low EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Collectives

CVE-2026-77165

Permanent File Locks due to Improper Access Control in Nextcloud Server

File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nextcloud

Products

Server

CVE-2026-76861

Netcore NR255-V 1.5.130703 Stack-Based Buffer Overflow in ntools_tcpdump_start_set.cgi

Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call when processing form values. An attacker can submit crafted input to this cgi endpoint to overflow the stack buffer and potentially execute arbitrary code.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Netcore

Products

Nr255-v

CVE-2026-76856

Netcore NR255-V 1.5.130703 Cross-Site Request Forgery in WAN/LAN Configuration Endpoints

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_set_cgi, and lan_ip_change_cgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration settings without consent.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Netcore

Products

Nr255-v

CVE-2026-75894

Reachable assertion at ranap_handle_co_dt()

In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Osmocom

Products

Osmo-iuh

CVE-2026-75893

Heap based buffer overflow at ipaccess_proxy_read_msg()

In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg()  function via IPA frame lengths.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Osmocom

Products

Osmo-bsc

CVE-2026-75892

Out of bounds write in PDP ctx GSN-Address decode

In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-field, leading to memory corruption.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Osmocom

Products

Osmo-ggsn

CVE-2026-72733

Dokploy: OS Command Injection via `databaseName` / `backupFile` in database restore

Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the backup.restoreBackupWithLogs tRPC subscription builds database restore shell pipelines from the user-controlled databaseName and backupFile fields without safely separating them from shell syntax. packages/server/src/utils/restore/utils.ts interpolates databaseName into database-specific restore commands, while packages/server/src/utils/restore/postgres.ts and the analogous restore modules interpolate backupFile into rclone paths. An authenticated member with backup-restore permission can inject operating-system commands that execute in the Dokploy host context through execAsync or execAsyncRemote, even when no valid database container or backup file exists. This issue is fixed in version 0.29.13.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-63334

draw.io: SSRF via DNS rebinding in ProxyServlet bypasses private IP blocklist

draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vulnerable to server-side request forgery because src/main/java/com/mxgraph/online/Utils.java performs the private-address check in Utils.sanitizeUrl() using one DNS resolution, while src/main/java/com/mxgraph/online/ProxyServlet.java later calls URL.openConnection() and performs a second resolution. An attacker-controlled hostname can resolve to a public address during validation and then to a private, link-local, or cloud metadata address when the connection is opened. Successful exploitation can return cloud instance metadata or responses from internal HTTP services through the proxy. This issue is fixed in version 30.2.7.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Jgraph

Products

Drawio

CVE-2026-62987

Fabio - Incomplete fix for CVE-2025-48865: operator-configured trust headers (clientip/tls/requestid) still strippable via the Connection header

Fabio is an HTTP(S) and TCP router for deploying applications managed by consul. From 1.6.6 until 1.7.2, the CVE-2025-48865 fix in proxy/http_headers.go uses protectHeaders for a hardcoded set of forwarded headers but omits the operator-configured ClientIPHeader, TLSHeader, and RequestID names. In proxy/http_proxy.go, HTTPProxy.ServeHTTP calls addHeaders to set these trust headers before Go ReverseProxy processes the inbound Connection header, allowing an unauthenticated client to name and remove the configured headers before the request reaches the backend. Deployments that enable the corresponding proxy.header options can therefore lose client-IP, TLS-termination, or request-correlation signals used by backend authorization and auditing; the options are empty by default, and the hardcoded protected forwarded headers are unaffected. This issue is fixed in version 1.7.2.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Fabiolb

Products

Fabio

CVE-2026-62371

KubeEdge: Command Injection in NodeUpgradeJob - RCE on edge nodes via v1alpha2 API

KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. From 1.12.0 until 1.21.2, 1.22.2, and 1.23.1, the v1alpha2 NodeUpgradeJob handler in edge/pkg/taskmanager/actions/nodeupgradejob.go concatenates authenticated user-controlled spec.version and spec.image values into the keadm upgrade edge shell command. A user with permission to create or update NodeUpgradeJob resources can supply shell metacharacters in either field, causing arbitrary commands to execute on targeted edge nodes with the privileges of the upgrade process and compromising node confidentiality, integrity, and availability. This issue is fixed in versions 1.21.2, 1.22.2, and 1.23.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Kubeedge

Products

Kubeedge