CVE Watch20 de out. de 2026

CVE-2026-55467

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob opt

CVSS

2.5

Baixa

EPSS

0.2%

KEV

—

Exploit Today

0-100

Publicado: 15 de out. de 2026 · Última mod.: 20 de out. de 2026 · CWE-93 · CWE-94 · CWE-150

EPSS · 30d

0.2%EPSS · 30 dias0.2%

2026-10-162026-11-06

Descrição técnica

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20.

Referências oficiais

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-109683—

—

——0A newline injection vulnerability exists in the UPnP service of Archer BE805 v1 such that an adjacent attacker can supply newline characters in a UPnP port-mapping description due to improper sanitization, resulting in possible injection of unintended content into UPnP port-mapping data. Successful exploitation may allow an unauthenticated attacker on the local network to modify runtime UPnP port-mapping information and create spoofed entries within the affected service. The issue is limited to the integrity of UPnP mapping data and does not demonstrate code execution or privilege escalation.7h CVE-2026-1238475.3 MÉD

—

——0In JetBrains IntelliJ IDEA before 2026.3 command execution was possible via control characters in terminal command completion7h CVE-2026-1236758.3 ALT

—

——0A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a. This affects the function execute_code of the file im_client/agents/tools/code_executor.py of the component Code Executor Tool. This manipulation of the argument filename/lang causes code injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.9h CVE-2026-1039085.4 MÉD

—

——0The The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.1.18. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with custom-level access and above, to execute arbitrary shortcodes. The vulnerable output block is gated by the 'ampforwp-cat-description' setting, which is enabled by default, meaning the vast majority of installations are affected without any additional configuration change.11h CVE-2026-1232985.0 MÉD

—

——0In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible12h CVE-2026-879647.2 ALT

72.0%

——22The Product Feed Manager for WooCommerce – CTX Feed – Support 220+ Shopping, AI & Social Channels plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 8.0.26. This is due to insufficient sanitization of the `feedConfigCustom2` parameter — only `wp_unslash()` is applied before the value is stored verbatim via `update_option()`, and during feed generation the `Custom2Template::evaluate_return()` method passes the stored `{(return ...)}` template expressions directly to PHP's `eval()` function without any code-level sanitization. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to inject and execute arbitrary PHP code on the server, escalating their privileges beyond what the role normally permits to full remote code execution and site takeover. The `ctxfeed_custom2_eval_enabled` option defaults to `true`, meaning no additional administrator configuration is required for this attack path to be exploitable out of the box.17h