CVE-2026-93289

HighCVSS 7.5/10Last modified Sep 24, 2026

Description

The affected products are vulnerable to command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-932905.5Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapp CVE-2026-932919.4Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to e CVE-2026-932928.5SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servic CVE-2026-932946.3A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana CVE-2026-932958.7MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arg CVE-2026-932968.5MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the ser CVE-2026-93308.5IBM WebSphere Application Server 9.0, and 8.5 is affected by an improper validation of user-supplied data during deserialization using the S CVE-2026-933007.5The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all versions up to, and in CVE-2026-933028.2MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macr CVE-2026-933037.2The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via CVE-2026-933043.7A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at tha CVE-2026-933067.1IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is