rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-21570 
This High severity RCE (Remote Code Execution)  vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.

This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system.

Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions:
 Bamboo Data Center 9.6: Upgrade to a release greater than or equal to 9.6.24

 Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.16

 Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.3

See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).

This vulnerability was reported via our Atlassian (Internal) program.
Problem types: description: RCE (Remote Code Execution)
Affected products: vendor: Atlassian
product: Bamboo Data Center
Published: 2026-03-17T18:00:00.907Z
CVE-2026-21571 
This Critical severity OS Command Injection vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0,
11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center.
 
This RCE (Remote Code Execution) vulnerability, with a CVSS Score of 9.4 and a CVSS Vector of
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H allows an authenticated attacker to execute commands
on the remote system, which has high impact to confidentiality, high impact to integrity, high impact to availability,
and requires no user interaction.
 
Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade
your instance to one of the specified supported fixed versions:
 Bamboo Data Center 9.6.0: Upgrade to a release greater than or equal to 9.6.25
 Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.18 
 Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.6

See the release notes ([https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html]). You can download the latest version of Bamboo Data Center from the download center ([https://www.atlassian.com/software/bamboo/download-archives]).
Problem types: description: OS Command Injection
Affected products: vendor: Atlassian
product: Bamboo Data Center
Published: 2026-04-21T17:00:05.524Z
CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.SharedAuthorizationView' modules) allows Cross-Site Scripting (XSS). This vulnerability is associated with program files lib/hexpm_web/views/shared_authorization_view.ex and program routines 'Elixir.HexpmWeb.SharedAuthorizationView':render_grouped_scopes/3.

This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before c692438684ead90c3bcbfb9ccf4e63c768c668a8, from pkg:github/hexpm/hexpm@617e44c71f1dd9043870205f371d375c5c4d886d before pkg:github/hexpm/hexpm@c692438684ead90c3bcbfb9ccf4e63c768c668a8; hex.pm: from 2025-10-01 before 2026-01-19.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')
Affected products: vendor: hexpm
product: hexpm
cpes: cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: hexpm
product: hex.pm
default_status: unaffected
Credits: lang: en
value: Joud Zakharia / zentrust partners GmbH
lang: en
value: Jonatan Männchen / EEF
lang: en
value: Eric Meadows-Jönsson / Hex.pm
Published: 2026-01-19T14:22:46.770Z
CVE-2026-21619 Unsafe Deserialization of Erlang Terms in hex_core
Uncontrolled Resource Consumption, Deserialization of Untrusted Data vulnerability in hexpm hex_core (hex_api modules), hexpm hex (mix_hex_api modules), erlang rebar3 (r3_hex_api modules) allows Object Injection, Excessive Allocation. This vulnerability is associated with program files src/hex_api.erl, src/mix_hex_api.erl, apps/rebar/src/vendored/r3_hex_api.erl and program routines hex_core:request/4, mix_hex_api:request/4, r3_hex_api:request/4.

This issue affects hex_core: from 0.1.0 before 0.12.1; hex: from 2.3.0 before 2.3.2; rebar3: from 3.9.1 before 3.27.0.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: hexpm
product: hex_core
cpes: cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: hexpm
product: hex_core
cpes: cpe:2.3:a:hexpm:hex_core:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: hexpm
product: hex
cpes: cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: hexpm
product: hex
cpes: cpe:2.3:a:hexpm:hex:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: erlang
product: rebar3
cpes: cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: erlang
product: rebar3
cpes: cpe:2.3:a:erlang:rebar3:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Michael Lubas / Paraxial.io
lang: en
value: Jonatan Männchen / EEF
lang: en
value: Eric Meadows-Jönsson / Hex.pm
Published: 2026-02-27T17:57:11.513Z
CVE-2026-21620 TFTP Path Traversal
Relative Path Traversal, Improper Isolation or Compartmentalization vulnerability in erlang otp erlang/otp (tftp_file modules), erlang otp inets (tftp_file modules), erlang otp tftp (tftp_file modules) allows Relative Path Traversal. This vulnerability is associated with program files lib/tftp/src/tftp_file.erl, src/tftp_file.erl.

This issue affects otp: from 17.0, from 07b8f441ca711f9812fad9e9115bab3c3aa92f79; otp: from 5.10 before 7.0; otp: from 1.0.
Problem types: cwe_id: CWE-23
description: CWE-23 Relative Path Traversal
Affected products: vendor: Erlang
product: OTP
cpes: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: Erlang
product: OTP
default_status: unaffected
vendor: Erlang
product: OTP
default_status: unaffected
Credits: lang: en
value: Luigino Camastra / Aisle Research
lang: en
value: Jakub Witczak
lang: en
value: Raimo Niskanen
Published: 2026-02-20T10:57:08.620Z
CVE-2026-21621 Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access
Incorrect Authorization vulnerability in hexpm hexpm/hexpm ('Elixir.HexpmWeb.API.OAuthController' module) allows Privilege Escalation.

An API key created with read-only permissions (domain: "api", resource: "read") can be escalated to full write access under specific conditions.

When exchanging a read-only API key via the OAuth client_credentials grant, the resource qualifier is ignored. The resulting JWT receives the broad "api" scope instead of the expected "api:read" scope. This token is therefore treated as having full API access.

If an attacker is able to obtain a victim's read-only API key and a valid 2FA (TOTP) code for the victim account, they can use the incorrectly scoped JWT to create a new full-access API key with unrestricted API permissions that does not expire by default and can perform write operations such as publishing, retiring, or modifying packages.

This vulnerability is associated with program files lib/hexpm_web/controllers/api/oauth_controller.ex and program routines 'Elixir.HexpmWeb.API.OAuthController':validate_scopes_against_key/2.

This issue affects hexpm: from 71829cb6f6559bcceb1ef4e43a2fb8cdd3af654b before 71c127afebb7ed7cc637eb231b98feb802d62999.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: hexpm
product: hexpm
cpes: cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: hexpm
product: hex.pm
default_status: unaffected
Credits: lang: en
value: Michael Lubas / Paraxial.io
lang: en
value: Jonatan Männchen / EEF
Published: 2026-03-05T19:20:05.831Z
CVE-2026-21622 Password Reset Tokens Do Not Expire
Insufficient Session Expiration vulnerability in hexpm hexpm/hexpm ('Elixir.Hexpm.Accounts.PasswordReset' module) allows Account Takeover.

Password reset tokens generated via the "Reset your password" flow do not expire. When a user requests a password reset, Hex sends an email containing a reset link with a token. This token remains valid indefinitely until used. There is no time-based expiration enforced.

If a user's historical emails are exposed through a data breach (e.g., a leaked mailbox archive), any unused password reset email contained in that dataset could be used by an attacker to reset the victim's password. The attacker does not need current access to the victim's email account, only access to a previously leaked copy of the reset email.

This vulnerability is associated with program files lib/hexpm/accounts/password_reset.ex and program routines 'Elixir.Hexpm.Accounts.PasswordReset':can_reset?/3.

This issue affects hexpm: from 617e44c71f1dd9043870205f371d375c5c4d886d before bb0e42091995945deef10556f58d046a52eb7884.
Problem types: cwe_id: CWE-613
description: CWE-613 Insufficient Session Expiration
Affected products: vendor: hexpm
product: hexpm
cpes: cpe:2.3:a:hexpm:hexpm:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: hexpm
product: hex.pm
default_status: unaffected
Credits: lang: en
value: Michael Lubas / Paraxial.io
lang: en
value: Jonatan Männchen / EEF
lang: en
value: Eric Meadows-Jönsson / Hex.pm
Published: 2026-03-05T21:18:03.883Z
CVE-2026-21623 Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla
Lack of input filterung leads to a persistent XSS vulnerability in the forum post handling of the Easy Discuss component for Joomla.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Stackideas.com
product: EasyDiscuss extension for Joomla
default_status: unaffected
Credits: lang: en
value: adibou
lang: en
value: Swiss Paraplegic Research
Published: 2026-01-16T15:04:36.308Z
CVE-2026-21624 Extension - stackideas.com - Persistent XSS in EasyDiscuss component 1.0.0-5.0.15 for Joomla
Lack of input filterung leads to a persistent XSS vulnerability in the user avatar text handling of the Easy Discuss component for Joomla.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Stackideas.com
product: EasyDiscuss extension for Joomla
default_status: unaffected
Credits: lang: en
value: adibou
lang: en
value: Swiss Paraplegic Research
Published: 2026-01-16T15:05:37.172Z
CVE-2026-21625 Extension - stackideas.com - Lack of mime type validation in EasyDiscuss component 1.0.0-5.0.15 for Joomla
User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Stackideas.com
product: EasyDiscuss extension for Joomla
default_status: unaffected
Credits: lang: en
value: simoni
lang: en
value: Swiss Paraplegic Research
Published: 2026-01-16T15:06:15.596Z
CVE-2026-21626 Extension - stackideas.com - Information disclosure in post custom fields in EasyDiscuss 1.0.0-5.0.15 for Joomla
Access control settings for forum post custom fields are not applied to the JSON output type, leading to an ACL violation vector an information disclosure
Problem types: cwe_id: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Affected products: vendor: Stackideas.com
product: EasyDiscuss extension for Joomla
default_status: unaffected
Credits: lang: en
value: creative-graphics.ch
lang: en
value: djumla.de
Published: 2026-02-06T07:49:42.606Z
CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla
The vulnerability was rooted in how the Tassos Framework plugin handled specific AJAX requests through Joomla’s com_ajax entry point. Under certain conditions, internal framework functionality could be invoked without proper restriction.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: tassos.gr
product: Novarain/Tassos Framework (plg_system_nrframework)
default_status: unaffected
vendor: tassos.gr
product: Convert Forms
default_status: unaffected
vendor: tassos.gr
product: EngageBox
default_status: unaffected
vendor: tassos.gr
product: Google Structured Data
default_status: unaffected
vendor: tassos.gr
product: Advanced Custom Fields
default_status: unaffected
vendor: tassos.gr
product: Smile Pack
default_status: unaffected
Credits: lang: en
value: p1r0x / ssd-disclosure.com
Published: 2026-02-20T14:22:14.744Z
CVE-2026-21628 Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla
A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: astroidframe.work
product: Astroid Template Framework
default_status: unaffected
Credits: lang: en
value: David Jardin / Joomla Security Strike Team
Published: 2026-03-05T09:24:47.789Z
CVE-2026-21629 Joomla! Core - [20260301] - ACL hardening in com_ajax
The ajax component was excluded from the default logged-in-user check in the administrative area. This behavior was potentially unexpected by 3rd party developers.
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Joomla Security Strike Team
Published: 2026-04-01T09:03:37.772Z
CVE-2026-21630 Joomla! Core - [20260302] - SQL injection in com_content articles webservice endpoint
Improperly built order clauses lead to a SQL injection vulnerability in the articles webservice endpoint.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Antonio Morales from GitHub Security Lab Taskflow Agent
lang: en
value: vnth4nhnt from CyStack
Published: 2026-04-01T09:03:49.098Z
CVE-2026-21631 Joomla! Core - [20260303] - XSS vector in com_associations comparison view
Lack of output escaping leads to a XSS vector in the multilingual associations component.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: Shirsendu Mondal & Md Tanzimul Alam Fahim, UNC Pembroke
Published: 2026-04-01T09:03:17.208Z
CVE-2026-21632 Joomla! Core - [20260304] - XSS vectors in various article title outputs
Lack of output escaping for article titles leads to XSS vectors in various locations.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Joomla! Project
product: Joomla! CMS
default_status: unaffected
Credits: lang: en
value: peterhulst
Published: 2026-04-01T09:03:11.213Z
CVE-2026-21633 
A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier).

 

Affected Products:

UniFi Protect Application (Version 6.1.79 and earlier).

 

Mitigation:

Update your UniFi Protect Application to Version 6.2.72 or later.
Affected products: vendor: Ubiquiti Inc
product: UniFi Protect Application
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2026-01-05T16:47:38.510Z
CVE-2026-21634 
A malicious actor with access to the adjacent network could overflow the UniFi Protect Application (Version 6.1.79 and earlier) discovery protocol causing it to restart.


Affected Products:
UniFi Protect Application (Version 6.1.79 and earlier). 
 
Mitigation:
Update your UniFi Protect Application to Version 6.2.72 or later.
Affected products: vendor: Ubiquiti Inc
product: UniFi Protect Application
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2026-01-05T16:47:38.917Z
CVE-2026-21635 
An Improper Access Control could allow a malicious actor in Wi-Fi range to the EV Station Lite (v1.5.2 and earlier) to use WiFi AutoLink feature on a device that was only adopted via Ethernet.
Affected products: vendor: Ubiquiti Inc
product: UniFi Connect EV Station Lite
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Published: 2026-01-05T16:47:39.081Z
CVE-2026-21636 
A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

* The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-01-20T20:41:55.700Z
CVE-2026-21637 
A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.
Affected products: vendor: nodejs
product: node
default_status: unaffected
Published: 2026-01-20T20:41:55.352Z
CVE-2026-21638 
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.


Affected Products:
UBB-XG (Version 1.2.2 and earlier) 
UDB-Pro/UDB-Pro-Sector  (Version 1.4.1 and earlier) 
UBB  (Version 3.1.5 and earlier) 
 
Mitigation:
Update your UBB-XG to Version 1.2.3 or later.
Update your UDB-Pro/UDB-Pro-Sector  to Version 1.4.2 or later.
Update your UBB to Version 3.1.7 or later.
Affected products: vendor: Ubiquiti Inc
product: UBB-XG
default_status: unaffected
vendor: Ubiquiti Inc
product: UDB-Pro/UDB-Pro-Sector
default_status: unaffected
vendor: Ubiquiti Inc
product: UBB
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Published: 2026-01-08T16:14:22.563Z
CVE-2026-21639 
A malicious actor in Wi-Fi range of the affected product could leverage a vulnerability in the airMAX Wireless Protocol to achieve a remote code execution (RCE) within the affected product.

 

Affected Products:

airMAX AC (Version 8.7.20 and earlier)
airMAX M (Version 6.3.22 and earlier)
airFiber AF60-XG (Version 1.2.2 and earlier)
airFiber AF60 (Version 2.6.7 and earlier)

 

Mitigation:

Update your airMAX AC to Version 8.7.21 or later.
Update your airMAX M to Version 6.3.24 or later.
Update your airFiber AF60-XG to Version 1.2.3 or later.
Update your airFiber AF60 to Version 2.6.8 or later.
Affected products: vendor: Ubiquiti Inc
product: airMAX AC
default_status: unaffected
vendor: Ubiquiti Inc
product: airMAX M
default_status: unaffected
vendor: Ubiquiti Inc
product: airFiber AF60-XG
default_status: unaffected
vendor: Ubiquiti Inc
product: airFiber AF60
default_status: unaffected
Published: 2026-01-08T16:14:22.626Z
CVE-2026-21640 
HackerOne community member Faraz Ahmed (PakCyberbot) has reported a format string injection in the Revive Adserver settings. When specific character combinations are used in a setting, the admin user console could be disabled due to a fatal PHP error.
Affected products: vendor: Revive
product: Revive Adserver
default_status: unaffected
Published: 2026-01-20T20:48:47.940Z
CVE-2026-21641 
HackerOne community member Jad Ghamloush (0xjad) has reported an authorization bypass vulnerability in the `tracker-delete.php` script of Revive Adserver. Users with permissions to delete trackers are mistakenly allowed to delete trackers owned by other accounts.
Affected products: vendor: Revive
product: Revive Adserver
default_status: unaffected
Published: 2026-01-20T20:48:47.885Z
CVE-2026-21642 
HackerOne community member Patrick Lang (7yr) has reported a reflected XSS vulnerability in the `banner-acl.php` and `channel-acl.php` scripts of Revive Adserver. An attacker can craft a specific URL that includes an HTML payload in a parameter. If a logged in administrator visits the URL, the HTML is sent to the browser and malicious scripts would be executed.
Affected products: vendor: Revive
product: Revive Adserver
default_status: unaffected
Published: 2026-01-20T20:48:48.079Z
CVE-2026-21643 
An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiClientEMS 7.4.4 may allow an unauthenticated attacker to execute unauthorized code or commands via specifically crafted HTTP requests.
Problem types: cwe_id: CWE-89
description: Execute unauthorized code or commands
Affected products: vendor: Fortinet
product: FortiClientEMS
cpes: cpe:2.3:a:fortinet:forticlientems:7.4.4:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
Published: 2026-02-06T08:24:43.877Z
CVE-2026-21654 Johnson Controls -Frick Quantum HD- Unauthenticated Remote Code Execution
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Johnson Controls Frick Controls Quantum HD allows OS Command Injection. Insufficient validation of input in certain parameters may permit unexpected actions, which could impact the security of the device before authentication occurs.This issue affects Frick Controls Quantum HD version 10.22 and prior.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Johnson Controls
product: Frick Controls Quantum HD
default_status: unaffected
Credits: lang: en
value: Noam Moshe of Claroty Team 82 Research group
Published: 2026-02-27T08:38:42.472Z