CVE-2026-75487

Cudy TR3000 before 2.5.42 Command Injection via WireGuard private_key Export

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via the WireGuard server private_key option. Attackers can save a private key containing $() command substitution, which runs when action_wireguards_export() passes it to luci.sys.exec during configuration export.

CVSS 4.0 · 8.6 High EPSS 2.4% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75488

Cudy TR3000 before 2.5.42 Stack Buffer Overflow via CWMP Basic Authorization Builder

Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS to corrupt stack memory via oversized credentials. Attackers controlling the ACS can send Username and Password values up to 256 bytes in TR-069 Download or Upload requests, overflowing 128-byte stack buffers and crashing the CWMP process.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75489

Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE

Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart Mesh Technology (SMT) onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT messages in Probe Request vendor IEs carrying an attacker-chosen SSID and pre-shared key, forcing unpaired devices to join attacker-controlled access points.

CVSS 4.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75490

Cudy TR3000 before 2.5.42 Unauthenticated RCE via mDNS Automesh Broker Adoption

Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers to run root commands by advertising a rogue automesh controller over mDNS. Attackers on the upstream Ethernet segment can advertise _cudycmagent._tcp records pointing to a malicious MQTT broker, then send commands encrypted with a fixed AES key that router/batchcmd.lua executes as root.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75491

Cudy TR3000 before 2.5.42 MQTT JWT Authentication Bypass via alg none Tokens

Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so that accepts unsigned JWTs using alg none. Attackers holding any Cudy-trusted client certificate can authenticate as admincudydevice on port 8883 and publish batchcmd requests to execute commands as root.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75492

Cudy TR3000 before 2.5.42 Stack Buffer Overflow via stun_client UDP Parser

Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP Connection Request parser that parses requests before verifying username or HMAC. Remote attackers can send a single crafted UDP datagram lacking a space in the request line, causing strncpy() to overflow a 10-byte stack buffer and crash stun_client for denial of service.

CVSS 4.0 · 8.7 High EPSS 2.1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75493

Cudy TR3000 before 2.5.42 Stack Buffer Overflow via obuspa KeyPassphrase Getter

Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098 WLANConfiguration KeyPassphrase parameter, which copies the stored value with strcpy() into a 4,096-byte stack buffer without a length check. A malicious or compromised ACS can set a 5,000-byte passphrase via SetParameterValues, and a later read of the parameter overflows the buffer and crashes obuspa, causing denial of service.

CVSS 4.0 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75494

Cudy TR3000 before 2.5.42 Curl Argument Injection via TR-069 Upload

Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to inject curl options through unfiltered Username and Password values in the easycwmpd Upload handler. Attackers can embed whitespace to add options like -o and --url to the root-run curl command, writing attacker-controlled HTTP responses to arbitrary files on the device.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75495

Cudy TR3000 before 2.5.42 OS Command Injection via TR-098 User Password Parameter

Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to execute commands as root by supplying a crafted InternetGatewayDevice.User.{i}.Password value. Attackers can send a SetParameterValues request with shell metacharacters that obuspa_system.lua concatenates into a luci.util.exec() command string, gaining root command execution.

CVSS 4.0 · 9.2 Critical EPSS 2.6% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75576

Cudy TR3000 before 2.5.42 Command Injection via VPN Configuration Upload Filename

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root via an unvalidated multipart filename in the CBI FileUpload handler. Attackers can upload a valid OpenVPN configuration file through the VPN client config page with a filename containing $() shell substitution, which is passed through Lua %q to /bin/sh -c.

CVSS 4.0 · 8.6 High EPSS 2.4% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75577

Cudy TR3000 before 2.5.42 Command Injection via vpn.export_conf WireGuard Private Key

Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to execute commands as root by storing a malicious WireGuard private key. Attackers can save a private_key containing $() shell substitution and call the vpn.export_conf method on the /cgi-bin/luci/rpc/app JSON-RPC endpoint, which passes the key to a wg pubkey shell command.

CVSS 4.0 · 8.6 High EPSS 2.4% KEV · Not listed

Vendors

—

Products

—

CVE-2026-75578

Cudy TR3000 before 2.5.42 Command Injection via OpenVPN Client Configuration Upload

Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which embeds the shellquote()-quoted remote host token of an uploaded OpenVPN configuration inside an already single-quoted sed program run by os.execute(), so the nested quotes terminate the outer quote. Authenticated administrators can upload an .ovpn file whose remote host token contains a semicolon to execute arbitrary commands as root.

CVSS 4.0 · 8.6 High EPSS 2.2% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126266

SiYuan from 3.6.0 before 3.8.9 Publish-Password Bypass via getDoc Regex Keywords

SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish visitors to bypass per-document passwords via regex search in getDoc. Attackers can send POST requests to /api/filetree/getDoc with queryMethod 3 and a broad regex to read protected body text returned in the unfiltered keywords field.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

B3log

Products

Siyuan

CVE-2026-126267

NocoDB from 0.300.0 before 2026.04.4 Denial of Service via MetaService Logging

NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to crash the server by triggering an unhandled promise rejection in MetaService metadata logging. Attackers can send a request leaving a lookup condition undefined, causing knex binding errors in the unawaited logHelper call that terminate the server process.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126268

NocoDB before 2026.08.0 IP Address Spoofing via Unconditional Proxy Trust

NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge their recorded source IP by supplying X-Forwarded-For headers, because Express trust proxy is enabled unconditionally. Attackers can write arbitrary source addresses into audit and request logs to mislead investigations and evade the per-address public API rate limiter.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126269

NocoDB before 2026.09.0 Stored XSS via Attachment MIME Type

NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to execute scripts by storing crafted attachment MIME types like text/html;image/png. Attackers can write the value through the records API so the /dltemp signed URL serves HTML inline, stealing session tokens from localStorage to impersonate victims.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126270

NocoDB before 2026.09.1 Unauthenticated Information Disclosure via Aggregated Meta Endpoint

NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of utils.controller.ts that exposes instance-wide metadata to anonymous callers. Unauthenticated attackers can request the endpoint to enumerate bases, user counts, shared and password-protected view counts, webhook counts, and live per-base row counts, while repeated requests amplify database query load.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126271

NocoDB before 2026.09.0 TLS Private Key Exposure via Data Source Read

NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to obtain TLS client private keys by reading a base's data source. The source read handler masked only the connection password, letting attackers retrieve the decrypted private key, client certificate and CA to connect directly to the external database, bypassing NocoDB permissions.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126272

NocoDB before 2026.09.0 Uncontrolled Resource Consumption via Bulk Record Endpoints

NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass bulk row-count limits by using session authentication instead of API tokens. Attackers with Editor write permission on one table can submit hundreds of thousands of rows to v1 and v2 bulk write routes, exhausting database connections, CPU, and memory.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb

CVE-2026-126273

NocoDB before 2026.09.0 Privilege Escalation via Incomplete Admin Bootstrap

NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips super-admin bootstrap when the admin password environment variable is empty. Unauthenticated attackers can call the public signup endpoint first on a fresh instance to receive Creator and Super Admin roles, gaining full administrative control.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Nocodb

Products

Nocodb