tag
Root
Realtek rtl819x Jungle SDK Unauthenticated Kernel Memory R/W via Debug IOCTLs (CVE-2026-36355)
The rtl8192cd Wi-Fi kernel driver in Realtek's out-of-tree rtl819x "Jungle SDK" exposes two IOCTLs — writemem (0x89F5) and readmem (0x89F6) — with no access-control checks. These debug handlers are gated only by a macro (IOCTLDEBUGCMD) that is defined…
OpenRemote — Expression Injection RCE in Rules Engine (CVE-2026-39842)
OpenRemote's Rules Engine evaluates user-supplied JavaScript rule expressions using the Java Nashorn scripting engine with no sandboxing, SecurityManager, or ClassFilter restrictions. While the API layer explicitly blocks non-superusers from creating Groovy…
OpenLearnX Unauthenticated RCE via Container Volume Mount (CVE-2026-41900)
OpenLearnX's /api/compiler/execute endpoint runs untrusted user-submitted code inside a sibling Docker container, but the blueprint carries no authentication decorator, so any unauthenticated request can trigger it. The pre-patch executeincontainer() function…
MeiG Smart FORGE_SLT711 GoAhead Unauthenticated OS Command Injection (CVE-2026-36356)
The GoAhead web server bundled with MeiG Smart FORGESLT711 4G LTE CPE devices exposes an unauthenticated HTTP endpoint, /action/SetRemoteAccessCfg, that interpolates user-controlled JSON input into a shell command without sanitization. A single…
Cisco Catalyst SD-WAN Manager Privilege Escalation (CVE-2026-20245)
CVE-2026-20245 is the seventh Cisco SD-WAN zero-day exploited in 2026. An authenticated attacker with netadmin privileges on Cisco Catalyst SD-WAN Manager can upload a specially crafted file to the CLI subsystem, triggering insufficient input validation and…
TossUp — TerraMaster TOS Unauthenticated Redis Root RCE + NFS LPE
TossUp is a pair of bugs against TerraMaster TOS NAS devices. The primary issue is that Redis 4.0.10 runs as root and listens on 0.0.0.0:6379 with no authentication — despite /etc/redis.conf containing bind 127.0.0.1, the init script starts Redis as…