CVE-2026-34007

MediumCVSS 6.9/10Last modified Oct 15, 2026

Description

An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands.

We have already fixed the vulnerability in the following version: Notes Station 3 3.9.11 and later

Metrics

CVSS 4.0 6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 15, 2026
Last modified: Oct 15, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-340088.5An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gain CVE-2026-340098.4An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an admini CVE-2026-34016.6A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipu CVE-2026-340148.4An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gai CVE-2026-340156.5A path traversal vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit t CVE-2026-340189.8An SQL injection vulnerability exists in CubeCart prior to 6.6.0, which may allow an attacker to execute an arbitrary SQL statement on the p CVE-2026-340195.3When Bidirectional Forwarding Detection (BFD) is configured in Static and Dynamic routing protocols, undisclosed traffic can cause the Traff CVE-2026-34024.8A security vulnerability has been detected in PHPGurukul Student Record Management System up to 1.0. This vulnerability affects unknown code CVE-2026-340207.5Use of GET Request Method With Sensitive Query Strings vulnerability in Apache OpenMeetings. The REST login endpoint uses HTTP GET method w CVE-2026-340218.6The Wertheim SafeController 5400, Controller 5400 - AssemblyVersion 6.11.8130.22320, uses RS-485 communication between the server and the mi CVE-2026-340227.1The Wertheim SafeController Family 65000, Controller 65000 - AssemblyVersion 6.11.8130.22319, uses weak custom cryptographic algorithms with CVE-2026-340237.1The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains an incorrect authorization vulnerability in the WebSocket co