CVE-2026-109830
A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and e
CVSS
7.3
Alta
EPSS
—
KEV
—
Exploit Today
0
0-100
Publicado: 10 de nov. de 2026 · Última mod.: 10 de nov. de 2026 · CWE-78
Ainda não há histórico EPSS suficiente.
A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01). Affected devices take parts from a configuration file and execute them unchecked. This could allow an attacker which is able to manipulate the configuration file to make the user execute arbitrary code on the device.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1229888.0 ALT—
——0Improper authorization in Windows Admin Center allows an authorized attacker to elevate privileges over a network.6hCVE-2026-1199067.8 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally.12hCVE-2026-1094578.0 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Azure CLI allows an authorized attacker to execute code over a network.11hCVE-2026-1022248.4 ALT—
——0Improper neutralization of special elements used in an os command ('os command injection') in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.10hCVE-2026-1260427.0 ALT—
——0VNote 3.11.0 before 4.12.0 contains an OS command injection vulnerability in its Tasks feature: magic variables such as ${bufferName} and ${selectedText} are substituted into a shell command string without escaping. Attackers can share a notebook containing a note whose filename or text includes shell metacharacters such as $(...), backticks, ; or |, executing commands as the victim when they run a task referencing these variables.11hCVE-2026-1054257.2 ALT—
——0OS command injection in Ivanti Sentry before versions 11.0.0, 10.8.3, and 10.7.4 as well as in Ivanti EPMM before versions 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.14h