CVE WatchJul 5, 2026

CVE-2026-36175

An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via

CVSS

6.8

Medium

EPSS

0.2%

KEV

—

Exploit Today

0-100

Published: Jun 4, 2026 · Last modified: Jul 5, 2026 · CWE-20 · CWE-288

EPSS · 30d

0.2%EPSS · 30 days0.2%

2026-06-302026-07-17

Technical description

An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via interrupting the boot sequence and injecting a crafted string into the kernel boot arguments.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2024-555919.8 CRI

99.9%

KEV—80Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability10d CVE-2026-341978.8 HIG

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability3d CVE-2025-244728.1 HIG

86.2%

KEV—76Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability10d CVE-2026-125699.8 CRI

66.0%

KEV—70PTC Windchill and FlexPLM Improper Input Validation Vulnerability17d CVE-2025-607877.2 HIG

97.0%

——29MotionEye v0.43.1b4 and before is vulnerable to OS Command Injection in configuration parameters such as image_file_name. Unsanitized user input is written to Motion configuration files, allowing remote authenticated attackers with admin access to achieve code execution when Motion is restarted.13d CVE-2017-149197.5 HIG

94.3%

——28Node.js before 4.8.5, 6.x before 6.11.5, and 8.x before 8.8.0 allows remote attackers to cause a denial of service (uncaught exception and crash) by leveraging a change in the zlib module 1.2.9 making 8 an invalid value for the windowBits parameter.4d