CVE-2026-76060

HighCVSS 8.8/10Last modified Aug 31, 2026

Description

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published
Aug 28, 2026
Last modified
Aug 31, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-760615.5A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or locCVE-2026-760636.4The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wfp_featured_CVE-2026-760667.5IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls agaCVE-2026-76078.8A security vulnerability has been detected in TRENDnet TEW-821DAP 1.12B01. Impacted is the function auto_update_firmware of the component FiCVE-2026-760709.8Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers toCVE-2026-760719.8Netis NC63 firmware through V3.0.0.3327 contains a stack-based buffer overflow vulnerability that allows unauthenticated remote attackers toCVE-2026-760727.4The Continue CLI applies an incomplete denylist as its only barrier to destructive shell commands when running unattended. In headless mode CVE-2026-760738.8Label Studio does not scope the annotation detail endpoint to the requesting user's organization. AnnotationAPI in label_studio/tasks/api.pyCVE-2026-760744.3The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable tCVE-2026-76088.0A vulnerability was detected in TRENDnet TEW-821DAP up to 1.12B01. The affected element is the function tools_diagnostic. The manipulation rCVE-2026-760815.5ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple projCVE-2026-760834.9Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/j