Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 720 | 0,2 % |
| ≥50 % | 3.224 | 0,9 % |
| ≥10 % | 22.120 | 6,0 % |
| <10 % | 343.497 | 92,9 % |
CVE-2016-0763 | Apache Tomcat 7.0/8.0/9.0 ResourceLinkFactory.setGlobalContext access control (RHSA-2016:1087 / Nessus ID 88936)
A vulnerability was found in Apache Tomcat 7.0/8.0/9.0. It has been rated as critical. Affected by this vulnerability is the function ResourceLinkFactory.setGlobalContext. Performing a manipulation results in improper access controls. This
CVE-2016-0714 | Oracle Communications 12.x Policy Management access control (Nessus ID 90274 / ID 350024)
A vulnerability categorized as critical has been discovered in Oracle Communications 12.x. This impacts an unknown function of the component Policy Management. Executing a manipulation can lead to improper access controls. This vulnerabilit
CVE-2016-0706 | Apache Tomcat 6.0/7.0/8.0/9.0 StatusManagerServlet information disclosure (RHSA-2016:1087 / Nessus ID 88935)
A vulnerability was found in Apache Tomcat 6.0/7.0/8.0/9.0 and classified as problematic. This affects an unknown function of the component StatusManagerServlet. The manipulation results in information disclosure. This vulnerability was nam
CVE-2016-0494 | Oracle Java SE 6u105/7u91/8u66 2D memory corruption (Nessus ID 88060 / ID 350055)
A vulnerability, which was classified as very critical, has been found in Oracle Java SE 6u105/7u91/8u66. Affected by this issue is some unknown functionality of the component 2D. The manipulation leads to memory corruption. This vulnerabil
CVE-2016-0483 | Oracle Java SE 6u105/7u91/8u66 AWT memory corruption (Nessus ID 88060 / ID 350048)
A vulnerability has been found in Oracle Java SE 6u105/7u91/8u66 and classified as very critical. This vulnerability affects unknown code of the component AWT. This manipulation causes memory corruption. This vulnerability is registered as
CVE-2016-0475 | Oracle Java SE 8u66 Libraries memory corruption (Nessus ID 88060 / ID 350055)
A vulnerability was found in Oracle Java SE 8u66 and classified as critical. This issue affects some unknown processing of the component Libraries. Such manipulation leads to memory corruption. This vulnerability is documented as CVE-2016-0
CVE-2016-0466 | Oracle Java SE 6u105/7u91/8u66 JAXP denial of service (Nessus ID 88060 / ID 350055)
A vulnerability was found in Oracle Java SE 6u105/7u91/8u66. It has been declared as problematic. The affected element is an unknown function of the component JAXP. Executing a manipulation can lead to denial of service. This vulnerability
CVE-2016-0448 | Oracle Java SE 6u105/7u91/8u66 JMX information disclosure (Nessus ID 88060 / ID 350055)
A vulnerability was found in Oracle Java SE 6u105/7u91/8u66. It has been rated as problematic. The impacted element is an unknown function of the component JMX. The manipulation leads to information disclosure. This vulnerability is traded
CVE-2016-0402 | Oracle Java SE 6u105/7u91/8u66 Networking memory corruption (Nessus ID 88060 / ID 350055)
A vulnerability was found in Oracle Java SE 6u105/7u91/8u66. It has been classified as problematic. Impacted is an unknown function of the component Networking. Performing a manipulation results in memory corruption. This vulnerability is r
CVE-2016-0055 | Microsoft Office up to 2016 memory corruption (MS16-015 / Nessus ID 88647)
A vulnerability was found in Microsoft Office 2007 SP3/2010 SP2/2013 RT SP1/2013 SP1/2016. It has been declared as critical. This impacts an unknown function. Such manipulation leads to memory corruption. This vulnerability is referenced as
CVE-2016-0035 | Microsoft Excel up to 2016 Office Document memory corruption (MS16-004 / Nessus ID 87882)
A vulnerability labeled as critical has been found in Microsoft Excel up to 2016. The impacted element is an unknown function of the component Office Document Handler. Executing a manipulation can lead to memory corruption. This vulnerabili
CVE-2016-0012 | Microsoft Office up to 2016 ASLR information disclosure (MS16-004 / Nessus ID 87882)
A vulnerability marked as critical has been reported in Microsoft Office up to 2016. Impacted is an unknown function of the component ASLR. Performing a manipulation results in information disclosure. This vulnerability is reported as CVE-2
CVE-2016-0011 | Microsoft SharePoint Foundation 2013 SP1 Access Control Policy cross site scripting (MS16-004 / Nessus ID 87882)
A vulnerability labeled as problematic has been found in Microsoft SharePoint Foundation 2013 SP1. This issue affects some unknown processing of the component Access Control Policy. Such manipulation leads to cross site scripting. This vuln
CVE-2016-0010 | Microsoft Office up to 2016 Office Document memory corruption (MS16-004 / Nessus ID 87882)
A vulnerability identified as critical has been detected in Microsoft Office up to 2016. This vulnerability affects unknown code of the component Office Document Handler. This manipulation causes memory corruption. This vulnerability is reg
CVE-2026-101950 | Juniper Networks Junos OS up to 26.2R1-S1 SVR heap-based overflow (WID-SEC-2026-3976)
A vulnerability was found in Juniper Networks Junos OS up to 26.2R1-S1. It has been classified as very critical. The impacted element is an unknown function of the component SVR. Performing a manipulation results in heap-based buffer overfl
CVE-2026-101949 | Juniper Networks Junos OS/Junos OS Evolved Routing Protocol Daemon null pointer dereference (WID-SEC-2026-3976)
A vulnerability was found in Juniper Networks Junos OS and Junos OS Evolved and classified as critical. This affects an unknown function of the component Routing Protocol Daemon. The manipulation results in null pointer dereference. This vu
CVE-2026-101948 | Juniper Networks Junos OS/Junos OS Evolved Routing Protocol Daemon null pointer dereference (WID-SEC-2026-3976)
A vulnerability, which was classified as critical, has been found in Juniper Networks Junos OS and Junos OS Evolved. This impacts an unknown function of the component Routing Protocol Daemon. Performing a manipulation results in null pointe
CVE-2026-101946 | Juniper Networks Junos OS/Junos OS Evolved rpd process out-of-bounds (WID-SEC-2026-3976)
A vulnerability, which was classified as problematic, has been found in Juniper Networks Junos OS and Junos OS Evolved. Impacted is an unknown function of the component rpd process. Performing a manipulation results in out-of-bounds read. T
CVE-2026-101945 | Juniper Networks Junos OS/Junos OS Evolved rpd process integer overflow (WID-SEC-2026-3976)
A vulnerability identified as critical has been detected in Juniper Networks Junos OS and Junos OS Evolved. This affects an unknown part of the component rpd process. The manipulation leads to integer overflow. This vulnerability is documen
CVE-2026-101944 | Juniper Junos OS/Junos OS Evolved RPD integer overflow (WID-SEC-2026-3976)
A vulnerability classified as critical has been found in Juniper Junos OS and Junos OS Evolved. Affected by this issue is some unknown functionality of the component RPD. This manipulation causes integer overflow. This vulnerability appears
CVE-2026-101943 | Juniper Networks Junos OS/Junos OS Evolved Routing Protocol Daemon input validation (WID-SEC-2026-3976)
A vulnerability marked as critical has been reported in Juniper Networks Junos OS and Junos OS Evolved. Affected is an unknown function of the component Routing Protocol Daemon. The manipulation leads to improper input validation. This vuln
Statically catching the CVE-2026-34445 ONNX external_data attribute-injection vector before the model loads
Made with AI: the scanner and this post were made with AI agents working for me, MV2 of Munim, Inc. An .onnx file looks like a safe thing to download. It is a protobuf message with no code of its own: no pickle, no Lambda layer, nothing tha
CVE-2022-46639 | Correos Prestashop 1.7.x descarga_etiqueta.php path traversal (EUVD-2022-49443)
A vulnerability labeled as critical has been found in Correos Prestashop 1.7.x. This affects an unknown function of the file descarga_etiqueta.php. Such manipulation leads to path traversal. This vulnerability is traded as CVE-2022-46639. A
CVE-2022-46637 | Prolink PRS1841 Telnet/FTP hard-coded credentials (ID 170342 / EUVD-2022-49441)
A vulnerability classified as critical was found in Prolink PRS1841. Affected by this vulnerability is an unknown functionality of the component Telnet/FTP. Such manipulation leads to hard-coded credentials. This vulnerability is documented
CVE-2022-46634 | TOTOLINK A7100RU 7.4cu.2313_B20191024 setting/setWiFiWpsCfg wscDisabled command injection (EUVD-2022-49438)
A vulnerability identified as critical has been detected in TOTOLINK A7100RU 7.4cu.2313_B20191024. Affected by this issue is some unknown functionality of the file setting/setWiFiWpsCfg. Performing a manipulation of the argument wscDisabled
CVE-2022-46631 | TOTOLINK A7100RU 7.4cu.2313_B20191024 setting/setWiFiSignalCfg wscDisabled command injection (EUVD-2022-49435)
A vulnerability categorized as critical has been discovered in TOTOLINK A7100RU 7.4cu.2313_B20191024. Affected by this vulnerability is an unknown functionality of the file setting/setWiFiSignalCfg. Such manipulation of the argument wscDisa
CVE-2022-46624 | Online Graduate Tracer System 1.0.0 name cross site scripting (EUVD-2022-49428)
A vulnerability was found in Online Graduate Tracer System 1.0.0. It has been rated as problematic. This vulnerability affects unknown code. This manipulation of the argument Name causes cross site scripting. This vulnerability is handled a
CVE-2022-46623 | Judging Management System 1.0.0 username sql injection (EUVD-2022-49427)
A vulnerability was found in Judging Management System 1.0.0 and classified as critical. This affects an unknown part. Such manipulation of the argument Username leads to sql injection. This vulnerability is traded as CVE-2022-46623. Access
CVE-2022-46622 | Judging Management System 1.0 firstname cross site scripting (EUVD-2022-49426)
A vulnerability was found in Judging Management System 1.0. It has been rated as problematic. Impacted is an unknown function. The manipulation of the argument firstname leads to cross site scripting. This vulnerability is uniquely identifi
CVE-2022-46610 | 72crm 9.0 unrestricted upload (Issue 36 / EUVD-2022-49414)
A vulnerability, which was classified as critical, was found in 72crm 9.0. This affects an unknown function. Executing a manipulation can lead to unrestricted upload. This vulnerability is handled as CVE-2022-46610. The attack can be execut
CVE-2022-46603 | Inkdrop 5.4.1 Markdown File unrestricted upload (EUVD-2022-49407)
A vulnerability was found in Inkdrop 5.4.1 and classified as problematic. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation results in unrestricted upload. This vulnerability is id
Your MCP Server Is the Attack Surface Now
Your MCP Server Is the Attack Surface Now October 2026 has been the worst month yet for Model Context Protocol security. Not because attackers discovered something new, but because they keep rediscovering the same flaws in server after serv
CVE-2026-78850 | Infor Matomo 5.11.2 SiteContentDetector information disclosure (EUVD-2026-102185)
A vulnerability was found in Infor Matomo 5.11.2. It has been rated as problematic. This issue affects some unknown processing of the component SiteContentDetector. This manipulation causes information disclosure. This vulnerability is hand
CVE-2026-110736 | godotengine Godot Engine up to 4.7.2 optimized translation loader optimized_translation.cpp get_message out-of-bounds (EUVD-2026-101289)
A vulnerability was found in godotengine Godot Engine up to 4.7.2. It has been declared as problematic. Impacted is the function OptimizedTranslation::get_message of the file core/string/optimized_translation.cpp of the component optimized
CVE-2026-78851 | Grav up to 2.0.6 GravExtension.php mediaDirFunc path traversal (EUVD-2026-102184)
A vulnerability was found in Grav up to 2.0.6 and classified as problematic. Affected by this issue is the function mediaDirFunc of the file GravExtension.php. Executing a manipulation can lead to path traversal. This vulnerability appears
CVE-2022-46601 | TRENDnet TEW755AP 1.13B01 icp_setbg_img setbg_num stack-based overflow (EUVD-2022-49405)
A vulnerability identified as critical has been detected in TRENDnet TEW755AP 1.13B01. This vulnerability affects the function icp_setbg_img. The manipulation of the argument setbg_num leads to stack-based buffer overflow. This vulnerabilit
CVE-2022-46600 | TRENDnet TEW755AP 1.13B01 set_sta_enrollee_pin_24g wps_sta_enrollee_pin stack-based overflow (EUVD-2022-49404)
A vulnerability categorized as critical has been discovered in TRENDnet TEW755AP 1.13B01. This affects the function set_sta_enrollee_pin_24g. Executing a manipulation of the argument wps_sta_enrollee_pin can lead to stack-based buffer overf
CVE-2022-46599 | TRENDnet TEW755AP 1.13B01 icp_setlogo_img setlogo_num stack-based overflow (EUVD-2022-49403)
A vulnerability was found in TRENDnet TEW755AP 1.13B01. It has been rated as critical. Affected by this issue is the function icp_setlogo_img. Performing a manipulation of the argument setlogo_num results in stack-based buffer overflow. Thi
CVE-2026-73179 | Apache CXF up to 3.6.12/4.1.8/4.2.3 JPA OAuth2 Authorization Code Grant Provider race condition (EUVD-2026-95695 / WID-SEC-2026-3824)
A vulnerability classified as problematic was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. The affected element is an unknown function of the component JPA OAuth2 Authorization Code Grant Provider. Executing a manipulation can lead to race
CVE-2026-110924 | Red Hat Enterprise Linux GSSAPI improper authentication (EUVD-2026-102054)
A vulnerability was found in Red Hat Enterprise Linux, Hardened Images and OpenShift Container Platform. It has been declared as critical. The impacted element is an unknown function of the component GSSAPI. The manipulation results in impr
CVE-2026-78384 | Apache CXF up to 3.6.12/4.1.8/4.2.3 Compression Utils CompressionUtils.inflate resource consumption (EUVD-2026-95696 / WID-SEC-2026-3824)
A vulnerability was found in Apache CXF up to 3.6.12/4.1.8/4.2.3. It has been declared as problematic. Affected by this issue is the function CompressionUtils.inflate of the component Compression Utils. Executing a manipulation can lead to
CVE-2026-111252 | A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities can expand to a very large value and exhaust the server memory. An authenticated user with provisioning access can supply such a document through a requisition or foreign-source import, which includes a remote requisition U
A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without an effective limit on entity expansion. A document with a DOCTYPE that declares internal entities c
Silent Lynx nutzt WinRAR-Fehler für Reverse-Shell-Zugriff in CIS-Regierungen
LONDON (IT BOLTWISE) – Ein Angreifer namens Silent Lynx soll über mehrere Jahre gezielt Regierungsorganisationen im CIS-Raum kompromittiert haben. In der aktuellen Vorgehensweise kombiniert das Cluster Makro-Dokumente, PS2EXE-Downloader und
CVE-2026-87029 | undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a
undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catc
CVE-2026-111234 | SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link pointing to a file:// path, causing file_get_contents() to read files accessible to the web server process.
SimplePie through 1.9.0 contains a local file read vulnerability that allows malicious feed servers to read server files by supplying file:// URLs in redirects or autodiscovery links. Attackers can return a Location header or feed link poin
CVE-2026-111233 | Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewall rules privileges into opening a crafted GET link to execute script in the WebGUI with their privileges.
Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interfa
CVE-2026-111232 | Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can submit a crafted separator[] color value that display_separator() renders unencoded into class attributes, executing in administrators' browsers to perform WebGUI actions with their privileges.
Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port Forward privileges to inject scripts via the separator color field. Attackers can
CVE-2026-111231 | Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege. Attackers holding page privileges for services_acb.php, uploadconfig.php, diag_confbak.php, or diag_backup.php can install a chosen config.xml to gain root-level code execution after reload or reboot.
Netgate pfSense CE through 2.9.0 contains an authorization bypass vulnerability that allows read-only WebGUI users to replace config.xml because config_restore() and config_install() ignore the 'User - Config: Deny Config Write' privilege.
CVE-2026-111230 | Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a non-matching Result Match string so _checkStatus() logs file contents such as /conf/config.xml or /etc/master.passwd to the system log.
Netgate pfSense CE through 2.9.0 contains a local file read vulnerability that allows users with the Dynamic DNS client privilege to read files as root by setting a file:// custom Update URL in services_dyndns_edit.php. Attackers can set a
CVE-2026-111229 | pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a malicious XMLRPC server returning connected_users with shell metacharacters in ip or mac fields, which captiveportal_load_pfctl passes unescaped to a pfctl shell command.
pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only the Captive Portal HA privilege to execute commands as root. Attackers can set backwardsyncip to a ma
CVE-2026-111228 | Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/LF characters in the unvalidated sock_queue_timeout parameter, which is written raw into unbound.conf, to override local records and forwarding for all clients.
Netgate pfSense CE from 2.7.1 through 2.9.0 contains a CRLF injection vulnerability in services_unbound_advanced.php that allows authenticated users with DNS Resolver: Advanced privilege to inject Unbound directives. Attackers can embed CR/
CVE-2026-111227 | Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can embed CR/LF characters in the aclname or aclaction fields written to access_lists.conf to add local-data, local-zone, or forward-zone directives and control DNS answers served to LAN clients.
Netgate pfSense CE through 2.9.0 contains a CRLF injection vulnerability in services_unbound_acls.php that allows authenticated users with the DNS Resolver: Access Lists privilege to inject Unbound configuration directives. Attackers can em
CVE-2026-111226 | pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshguard threshold, block time, or detection time values containing newlines or $(...) that are written unvalidated to sshguard.conf and sourced as root on restart.
pfSense CE 2.4.5 through 2.9.0 contains an OS command injection vulnerability that allows authenticated WebGUI users with Advanced Admin Access privilege to execute commands as root via Login Protection settings. Attackers can submit sshgua
CVE-2026-111225 | Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the certificate common name or username, which is interpolated unquoted into su -c strings, when DNS Resolver client registration is enabled.
Netgate pfSense CE 2.5.0 through 2.9.0 contains an OS command injection vulnerability in openvpn.learn-address.sh that allows authenticated VPN clients to execute commands as the unbound user. Attackers can embed shell metacharacters in the
CVE-2026-111224 | pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RADIUS or LDAP can use usernames containing single quotes and shell metacharacters to break out of the eval'd pfctl anchor name on connect or disconnect.
pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authenticated VPN users to execute commands as root via crafted usernames. Attackers authenticated through RA
CVE-2026-111223 | Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line banner containing '}' to escape the unquoted strongswan.conf attr value and define charon.start-scripts entries that charon executes as root on restart.
Netgate pfSense CE 2.7.0 through 2.9.0 contains a configuration injection vulnerability that allows authenticated users with IPsec Mobile privileges to execute commands as root via the login_banner field. Attackers can submit a single-line
CVE-2026-111222 | Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newline to add auto_prepend_file pointing at /var/db/zoneinfo, executing PHP as root after php.ini is regenerated at boot or php-fpm restart.
Netgate pfSense CE through 2.9.0 contains a php.ini injection vulnerability that allows authenticated users with General Setup privileges to inject directives by submitting an unvalidated timezone value. Attackers can embed a quote and newl
CVE-2026-111221 | Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privileges can POST a secret containing a quote and newline to vpn_l2tp.php or services_pppoe_edit.php, appending an up-script that executes as root when a session starts.
Netgate pfSense CE through 2.9.0 contains a configuration injection vulnerability that allows authenticated WebGUI users to inject mpd5 commands by submitting an unescaped RADIUS shared secret. Attackers with L2TP or PPPoE Server edit privi
CVE-2026-111220 | pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding the 'WebCfg - Interfaces: PPPs: Edit' privilege can submit crafted POST values that configure_cron() writes unescaped into /etc/crontab, running arbitrary root commands on schedule.
pfSense CE through 2.9.0 contains a crontab injection vulnerability in interfaces_ppps_edit.php that allows authenticated users to execute commands as root by injecting newlines into the ptpid or reset hour/minute fields. Attackers holding
CVE-2026-111219 | Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making mpd5 run commands as root when a PPPoE client authenticates.
Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in services_pppoe_edit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit priv