CVE-2026-105487

MediumCVSS 6.3/10Last modified Oct 6, 2026

Description

A vulnerability was found in yogeshojha reNgine up to 2.2.0. Affected by this vulnerability is the function subdomain_discovery of the file web/reNgine/tasks.py of the component listTargets Endpoint. The manipulation of the argument Name results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used. The pull request to fix this issue awaits acceptance.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-77CWE-78

Affected software

VendorProductVersions
yogeshojhareNgine2.0; 2.1; 2.2.0

References

Timeline

Published
Oct 6, 2026
Last modified
Oct 6, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1054887.1Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vauCVE-2026-1054899.9Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerabCVE-2026-105495.3LDAP filter injection vulnerability in Yandex Database prior to 25.3.1.25 allows a remote attacker with valid LDAP credentials to bypass groCVE-2026-1054908.8Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1054918.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1054925.3Out-of-bounds read in Microsoft Remote Registry Service allows an authorized attacker to deny service over a network.CVE-2026-1054938.8Stack-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1054947.8Untrusted search path in Azure NFS mount helper (aznfs) allows an authorized attacker to elevate privileges locally.CVE-2026-1054958.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1054968.8Double free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1054978.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.CVE-2026-1054988.8Heap-based buffer overflow in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
CVE-2026-105487: Medium severity, CVSS 6.3 | Vulnix