PULSEUnderground Intel

EN VIVO17señales / 24h

FEED

ransompanzer reclama a RE/MAX Germany · DE · Professional Servicesransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerceransomplay reclama a ARRB Group · AU · Government & Defenseransomincransom reclama a Advantage Archives · US · Professional Servicesransomincransom reclama a sportsmansguide.com · US · Retail & E-Commerceransomwallstreet reclama a Walgreen Co. · US · Retail & E-Commerceransomaoqin reclama a The Tidewater Inn · US · Hospitalityransomdark project reclama a The CCMC · CAransombravox reclama a World Wide Fittings · US · Manufacturingransomakira reclama a Galorath · US · Professional Servicesransomakira reclama a Replogle Globes · US · Manufacturingransomakira reclama a Paragon Mechanical · Manufacturingransompanzer reclama a RE/MAX Germany · DE · Professional Servicesransomcurious worm reclama a i*t*r***t.com · Technologyransomcurious worm reclama a t**a.comransomplay reclama a Frey Properties of Highland LLC · US · Retail & E-Commerceransomplay reclama a ARRB Group · AU · Government & Defenseransomincransom reclama a Advantage Archives · US · Professional Servicesransomincransom reclama a sportsmansguide.com · US · Retail & E-Commerceransomwallstreet reclama a Walgreen Co. · US · Retail & E-Commerceransomaoqin reclama a The Tidewater Inn · US · Hospitalityransomdark project reclama a The CCMC · CAransombravox reclama a World Wide Fittings · US · Manufacturingransomakira reclama a Galorath · US · Professional Servicesransomakira reclama a Replogle Globes · US · Manufacturingransomakira reclama a Paragon Mechanical · Manufacturing

← Todos los CVEs

CVE Watch13 nov 2026

CVE-2026-95379

Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8,

CVSS

—

Sin CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 13 nov 2026 · Última mod.: 13 nov 2026 · CWE-23

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Path traversal in the certificate.deleteCertificate JSON-RPC method (POST /api/rpc) of the turbineweb web interface in Zenitel VSFF6, VSFF8, VSFF8MP, VSFF8MN, and VSFT devices with software versions from 10.0.3.0 before 10.1.3.0 allows authenticated administrators to delete arbitrary files as root via a relative path (../) in the file_name parameter. This can be used to cause denial of service or render the device inoperable by removing critical system files, and to weaken device security by removing files such as firewall rules or certificate trust stores.

Referencias oficiales

www.zenitel.comhttps://www.zenitel.com/sites/default/files/2026-11/A100K12404-Zenitel-Security-Advisory.pdf

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-124726—

———Relative Path Traversal, with Unintended Proxy vulnerability in Apache APISIX. A caller of the MCP endpoint can invoke endpoints the OpenAPI document never declared, under the declared tool's HTTP method, using the credentials the Route adds. This issue affects Apache APISIX: from 3.19.0 before 3.20.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.3h CVE-2026-107398—

———Indico is a feature-rich event management system. Prior to version 3.3.14, due to a path traversal vulnerability when building an "offline copy" of an event, a malicious event manager has the ability to retrieve the content of any local file that's readable by the user running Indico on the server. This issue has been patched in version 3.3.14.4h CVE-2026-1189767.5 ALT

———In Progress® Telerik® UI for Blazor versions v11.1.0 through v14.0.0, the demo application's Chat AI Integration example contains a relative path traversal vulnerability that could allow an attacker to read files outside of the chat attachments folder that are within the server's filesystem scope.11h CVE-2026-1114357.4 ALT

——11Relative path traversal vulnerability in openEuler iSulad on Linux. This vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c. This issue affects iSulad: through 2.1.6. In oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host.1d CVE-2026-120495—

——12Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows an attacker who controls the agent output of a monitored host's check output for a host to inject a crafted robot output to define the contents and location for the generated HTML log, leading to code execution as the site user.3d CVE-2026-125882—

——14Relative path traversal vulnerability in N-able N-central allows Path Traversal. This issue affects N-central: before 26.4.1.11h