CVE-2026-82971

CriticalCVSS 10.0/10Last modified Sep 1, 2026

Description

A vulnerability was determined in QVidium Opera11 3.3.2a26-Ax4x-opera11. This affects an unknown part of the file /cgi-bin/net_tr.cgi of the component CGI Script. This manipulation of the argument ipaddr causes command injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor explains: "QVidium has now closed its doors and no longer will be able to sell products or provide support." This vulnerability only affects products that are no longer supported by the maintainer.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-77

Affected software

Vendor	Product	Versions
QVidium	Opera11	3.3.2a26-Ax4x-opera11

References

Timeline

Published: Aug 31, 2026
Last modified: Sep 1, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-829739.4Improper neutralization of CRLF sequences in IMAP command construction in psyb0t/docker-mailbox before 0.4.13 allows a remote unauthenticate CVE-2026-829767.1A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP f CVE-2026-829778.4The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to 18.0.82.2, allows cross-sub CVE-2026-829784.3An authorization bypass in channel-edit.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager to create a delivery rule s CVE-2026-829806.3Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves f CVE-2026-829824.3The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from app CVE-2026-829833.3The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting user has manage-level pe CVE-2026-829844.3When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member o CVE-2026-829856.5The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewi CVE-2026-829864.6The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though t CVE-2026-829877.5There exists a screen capture endpoint in vCast media streaming service in ViewSonic ViewBoard unknown allows a remote, unauthenticated atta CVE-2026-829887.5There exists an arbitrary file download in vCast APK delivery mechanism in ViewSonic ViewBoard unknown allows a remote, unauthenticated atta