CVE-2026-107459

CriticalCVSS 9.8/10Last modified Oct 8, 2026

Description

The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
OpenfindSecuShare Pro4

References

Timeline

Published
Oct 8, 2026
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1074609.1Server-Side Request Forgery (SSRF) protection in the UrlImageConverter component of Apache Fesod (Incubating) fesod-sheet 2.0.2-incubating cCVE-2026-1074666.1A flaw was found in flatpak-builder. This vulnerability allows an attacker to cause information disclosure by convincing a user or continuouCVE-2026-1074710.0IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due to a heap buffer overfCVE-2026-1074724.3An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impCVE-2026-1074746.5The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed notification-service credeCVE-2026-1074791.7An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module impacts the Qt FramewoCVE-2026-107487.2An authenticated user with the nx-licensing-create privilege can upload a specially crafted license file to execute arbitrary operating systCVE-2026-1074847.3An input and authorization validation vulnerability in Gaia Portal backend handlers could allow an authenticated, non-administrative user toCVE-2026-107497.2The Post Duplicator WordPress plugin before 3.0.15 does not safely handle custom meta-data during post duplication, storing attacker-supplieCVE-2026-107496Issue summary: Encrypting a CMS message to an EC certificate whose group order is 1 may cause CMS_encrypt() or CMS_encrypt_ex() to loop indeCVE-2026-10754.3The ZT Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to CVE-2026-107508.1The Royal MCP WordPress plugin before 1.4.26 does not perform capability checks on the majority of its MCP tools after token authentication
CVE-2026-107459: Critical severity, CVSS 9.8 | Vulnix