CVE-2026-78229

MediumCVSS 6.7/10Last modified Sep 30, 2026

Description

Image Scanner Driver for Linux contains an OS command injection vulnerability. An attacker who can log in to a Linux system where the affected product is installed may execute an arbitrary OS command by making certain preparations.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Sep 30, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-78239.8A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/c CVE-2026-782306.0AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds CVE-2026-782315.3When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied O CVE-2026-782349.9A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace CVE-2026-782368.8An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by communicating over Cross CVE-2026-782377.8Insufficient input validation in ABR allows a low-privileged user to inject malicious entries into the sudoers file, resulting in persistent CVE-2026-782384.8SOY Gallery contains a cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who is loggin CVE-2026-782399.8Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable ad CVE-2026-78245.9An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" (diagnostic) mode is enabled, the applicati CVE-2026-782425.7Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value t CVE-2026-782432.1Apache YuniKorn 1.8.0 and later, if configured with the LDAP group resolver, crashes due to an out of bounds read processing group membershi CVE-2026-782447.3A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the