tag
Network
Fortinet FortiSandbox "Start VNC" OS Command Injection (CVE-2026-25089)
FortiSandbox's Web UI "start VNC" feature passes a caller-supplied virtual machine name into an OS command without proper neutralization of shell metacharacters, allowing an unauthenticated attacker to inject arbitrary commands executed on the underlying…
libssh2 SSH Packet Length OOB Heap Write / Unauthenticated RCE (CVE-2026-55200)
CVE-2026-55200 is a critical heap out-of-bounds write in libssh2's SSH transport layer (ssh2transportread() in src/transport.c). The function validates that packetlength is greater than zero but performs no upper-bound check, allowing an attacker-controlled…
GeoVision GV-I/O Box 4E DVRSearch Unauthenticated Stack Buffer Overflow RCE (CVE-2026-12485)
CVE-2026-12485 is a CVSS 10.0 unauthenticated stack-based buffer overflow in the GeoVision GV-I/O Box 4E, a Linux-based smart I/O device used in physical security and building automation. The DVRSearch service listens on UDP port 10001 and handles CMDIPSET…
Ubiquiti UniFi OS Unauthenticated RCE Chain (CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910)
A three-CVE unauthenticated RCE chain in Ubiquiti UniFi OS Server ≤ 5.0.6 allows a remote attacker to achieve root-level command execution with no credentials. CVE-2026-34908 and CVE-2026-34909 (improper access control + path traversal) are chained to bypass…
TossUp — TerraMaster TOS Unauthenticated Redis Root RCE + NFS LPE
TossUp is a pair of bugs against TerraMaster TOS NAS devices. The primary issue is that Redis 4.0.10 runs as root and listens on 0.0.0.0:6379 with no authentication — despite /etc/redis.conf containing bind 127.0.0.1, the init script starts Redis as…