CVE-2026-107459

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Oct 8, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1074609.1Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating cCVE-2026-1074666.1A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuouCVE-2026-1074710.0IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overfCVE-2026-107487.2An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating systCVE-2026-107497.2The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplieCVE-2026-10754.3The ZT Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to CVE-2026-107508.1The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authenticationCVE-2026-1075037.1In Eclipse Ditto versions 3.6.0 to 3.8.13 and 3.9.0 to 3.9.7, the Ditto Explorer UI loads its complete environment configuration, including CVE-2026-1075067.5The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator alloCVE-2026-1075072.7The Squadeno WordPress plugin before 1.12.0 does not enforce its restrictions on every way a sport can be saved, allowing users with the loCVE-2026-1075088.6The Ultimate Multisite WordPress plugin before 2.17.2 does not validate a user-supplied value used to select a file to include, allowing unCVE-2026-107517.5IBM MQ Java and JMS client libraries could allow an authenticated attacker to execute arbitrary code on client applications due to a deseria
CVE-2026-107459: Critical severity, CVSS 9.8 | Vulnix