CVE Vulnerabilities - 12 October 2026

Edimax BR-6208AC allows remote command execution

CVE-2026-108918

The BR-6208AC wireless router can be tricked into running arbitrary commands through its /goform/formWlanMP interface. An attacker on the network can send specially crafted data to take control of the...

9.3

Edimax BR-6208AC can run attacker commands remotely

CVE-2026-108917

The Edimax BR-6208AC router (firmware 1.32) mishandles a firmware‑upgrade request, allowing an attacker to send a crafted message that makes the device execute unauthorized commands. This can be done ...

9.3

Netcore NR268 lets remote users bypass login

CVE-2026-108907

The Netcore NR268 version 1.7.121109 can be tricked into thinking a user is authorized when they are not. This can be done from anywhere on the internet, potentially giving an attacker access to the s...

9.3

Linksys E1700 allows remote code execution via MAC filter

CVE-2026-108892

The Linksys E1700 router can be tricked into running unwanted code when its MAC‑filter feature is used. An attacker can send specially crafted data to the router over the network and cause it to crash...

9.3

TRENDnet TEW‑751DR/752DRU/733GR remote command execution

CVE-2026-108804

The web‑based administration interface on these TRENDnet routers can be tricked into running arbitrary system commands. An attacker on the network could use this to take control of the router or learn...

9.3

IBM DataStage on Cloud Pak for Data lets attackers run code

CVE-2026-82110

A version of IBM DataStage running on Cloud Pak for Data does not correctly check file path names. An attacker who has a valid login could trick the system into accessing unexpected files and run thei...

9.9

Netcore NR268 router allows remote command injection via DDNS

CVE-2026-108929

The Netcore NR268 router (firmware version 1.7.121109) has a flaw in its DDNS setup page that lets an attacker send specially crafted data in the Hostname field to run commands on the device. This can...

9.4

IBM Db2 Mirror for i lets attackers gain admin rights

CVE-2026-96012

Versions 7.4, 7.5, and 7.6 of IBM Db2 Mirror for i can be tricked by a logged‑in user into running code with higher privileges than intended. This could let an attacker increase their access level on ...

9.9

Obsidian‑TC tokens can access any vault

CVE-2026-77366 GHSA-84c9-qqpq-2pq5

In versions before 1.3.1, the digital key used to talk to Obsidian‑TC did not lock you to a specific vault, so anyone with a valid key could choose a different vault and read, change, or delete its fi...

9.9

rebar3 can delete arbitrary directories when fetching dependencies

CVE-2026-103060 EEF-CVE-2026-103060 GHSA-6ggr-r7mh-2mv8 UBUNTU-CVE-2026-103060

When a developer uses rebar3 (versions from 3.7.0‑rc1 up to 3.27.1) to download project libraries, a specially crafted package can cause the tool to remove any folder on the system and place files the...

9.9

MarkLogic Server lets attacker run code with higher rights

CVE-2026-85955

Versions of MarkLogic Server 12 before 12.1.0 and 11 before 11.3.7 let anyone who can send queries run certain commands without the extra permission normally required. This could let a remote attacker...

9.9

Hex may delete files outside project during dependency fetch

CVE-2026-96612 EEF-CVE-2026-96612 GHSA-2vjj-c5hr-6xc3 DEBIAN-CVE-2026-96612

When a developer pulls packages with Hex version 0.6.0 up to 2.5.1, a malicious publisher can craft a package name that points to any folder, causing Hex to remove that folder and place the package th...

9.9

MarkLogic Server lets remote user gain admin control

CVE-2026-85948

Versions of MarkLogic Server before 12.1.0 and 11.3.7 contain a flaw in an old Management API that lets someone with basic management rights run unwanted commands. This can give the attacker lasting a...

9.9

MarkLogic Server allows forest manager to create admin account

CVE-2026-85947

Versions of MarkLogic Server 12 before 12.1.0 and 11 before 11.3.7 let a user who can manage forests add an administrator account without proper checks. That new account gives the attacker full contro...

9.9

IBM Planning Analytics may let attackers gain unauthorized access

CVE-2026-19622

Versions 2.0 and 2.1 of IBM Planning Analytics could allow a remote user to skip the login process and obtain higher privileges because the system does not correctly check certain internal requests. T...

9.8

IBM Maximo AI Service can run attacker code

CVE-2026-90920

The IBM Maximo AI Service versions 9.1.0 and 9.2.0 may let someone on the network cause the system to run their own code. This could let an attacker take control of the service or access data it handl...

9.8

Rapyd‑Admin allows anyone to log in as super‑admin

CVE-2026-109566

The Rapyd‑Admin tool (versions 9.0.0 through 9.19.x) creates a default admin account named admin@laravel with the password ‘admin’. Because this account is automatically recreated during setup, anyone...

9.3

GPT-SoVITS allows attackers to run commands via output folder field

CVE-2025-71429

The GPT-SoVITS software version up to 20250606v2pro lets an unauthenticated person type special text (like $(...)) into the UVR5 WebUI output folder box and cause the server to execute any command it ...

9.3

HAProxy Data Plane API lets unauthenticated users edit config

CVE-2026-109575

Versions 2.2.0 through 3.4.3 of HAProxy Data Plane API (both Community and Enterprise editions) can unintentionally turn off login checks for some management interfaces. An attacker who can reach an H...

9.8

PraisonAI agents can be listed and triggered without login

CVE-2026-57118

The PraisonAI system lets anyone view the names of its agents and send commands to them, even if they are not logged in. This can waste compute resources, reveal private information, and cause uninten...

9.8

PraiserAI agents can be listed and invoked without authentication

GHSA-x8cv-xmq7-p8xp CVE-2026-57118

Versions of PraiserAI before 1.6.59 let anyone view the list of agents and send commands to them, even without a login. This can waste your computing resources, expose private information, and trigger...

9.8

AnyDesk before 8.0.3 lets attackers run code as root

CVE-2026-109390

AnyDesk versions earlier than 8.0.3 contain a flaw that lets someone on the network send specially crafted data and cause the program to run any commands they choose, even without the user’s permissio...

9.8

static-eval package can run unauthorized code

GHSA-8v27-2fg9-7h62 CVE-2021-23334 ROOT-APP-NPM-CVE-2021-23334

The static-eval component used in several JavaScript projects can be tricked into executing code it should not run. This could let an attacker run harmful commands on your system. Update to the latest...

9.8

simple-git may allow unauthorized code execution

GHSA-9w5j-4mwv-2wj8 CVE-2022-25860 ROOT-APP-NPM-CVE-2022-25860

The simple-git library used in several projects could let an attacker run their own code on your system. This risk has been fixed in newer releases, and the updates are already published. Upgrade to t...

9.8

Spring Web library can be misused to run unsafe actions

GHSA-4wrc-f8pq-fpqp CVE-2016-1000027 ROOT-APP-MAVEN-CVE-2016-1000027 DEBIAN-CVE-2016-1000027

The Spring Web component used in many Java applications has a coding mistake that could let an attacker cause the program to behave incorrectly or expose data. This issue has been fixed in newer relea...

9.8