CVE-2026-105978

HighCVSS 7.2/10Last modified Nov 7, 2026

Description

Improper input validation in management control functions may allow a remote attacker with high privileges to inject operating system commands and execute them with root privileges.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
Welotec	TK100	>= 0.0.0, < 3.5.116
Welotec	TK500-v2	>= 0.0.0, < 1.0.124
Welotec	TK500-v3	>= 0.0.0, < 1.0.123

References

https://www.certvde.com/en/advisories/VDE-2026-119/

Timeline

Published: Nov 3, 2026
Last modified: Nov 7, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1059797.2Improper input validation in the ZeroTier VPN function may allow a remote attacker with high privileges to inject system commands and execut CVE-2026-1059807.2Improper input validation in the WireGuard VPN function may allow a remote attacker with high privileges to inject system commands and execu CVE-2026-1059817.2Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands a CVE-2026-1059827.2Improper input validation in the IPsec VPN function may allow a remote attacker with high privileges to inject system commands and execute t CVE-2026-1059858.8Craft CMS 5.10.13.2 contains an authenticated remote code execution vulnerability in the Control Panel action app/render-components. Any CVE-2026-1059868.7Incorrect authorization in the Admin API RBAC of Kong Gateway Enterprise allows a delegated administrator to elevate privileges via a perce CVE-2026-1059875.1KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an authenticated attacker c CVE-2026-1059895.3The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation check CVE-2026-105997.5The Integrate PhonePe with WooCommerce WordPress plugin through 1.2.1 does not validate that a verified payment transaction belongs to the o CVE-2026-1059905.3The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting sto CVE-2026-1059914.3IBM Db2 Genius Hub 1.1.2, 1.1.3, 1.1.4, 1.1.5 could allow a remote authenticated attacker to bypass security restrictions due to a missing C CVE-2026-1059925.3The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before