CVE-2026-101108

A vulnerability in Ziroom ZHOME A0101 version 1.0.1.0 affects unknown code in the file /api/ZRQos/set_online_client. Manipulation of the argument ip leads to command injection. The attack can be performed remotely, and the exploit is publicly available.

A flaw in Ziroom ZHOME A0101 version 1.0.1.0 affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Manipulation of the argument login_pwd leads to command injection. The attack can be performed remotely, and the exploit is published.

A vulnerability was detected in Ziroom ZHOME A0101 version 1.0.1.0, affecting unknown functionality of the file /api/ZRnetwork/firstLogin. Manipulation of the argument firstLogin results in command injection. The attack can be performed remotely, and the exploit is public.

PyJWT is a Python implementation of JSON Web Token standards. Prior to version 2.14.0, is_pem_format in jwt/utils.py does not recognize every PEM representation accepted by the cryptography loader. When an application mixes HMAC and asymmetric algorithms and supplies a mutated public-key PEM as raw key bytes, HMACAlgorithm.prepare_key treats the unrecognized asymmetric public key as an HMAC secret. An attacker who knows the public key can forge authenticated HMAC tokens. This issue is fixed in version 2.14.0.

A weakness in Ziroom ZHOME A0101 version 1.0.1.0 affects the function pop_usb_device in the file usr/lib/lua/luci/controller/api/zrUsb.lua of the USB Device Management API component. Manipulation of the argument path causes command injection. The attack can be performed remotely, and the exploit is publicly available.

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6. The books() function in site/booklibrary.php reads the field and direction request parameters and passes each through a function called protectInjectionWithoutQuote(), whose only real protection is a keyword blacklist that, on detecting the literal substring select, wraps the value in $db->quote() instead of rejecting it. The value is then concatenated directly into an unquoted ORDER BY clause, a position where quoting provides no protection at all. Reaching the vulnerable code path requires two conditions: a first request to prime session-stored sort defaults, and a trailing decoy comment (-- xselect) that satisfies the blacklist’s substring check without altering the payload’s effect.

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9. The site/realestatemanager.php file builds the ORDER BY clause of three separate frontend property-listing queries (category browsing, search results, and the full property listing) from a request-controlled order_field parameter, concatenated directly into an unquoted SQL clause with no allow-list of real column names and no cast.

Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforced session validation. The /api/* handlers (settings, devices, groups, per-device endpoints including /api/device/{mac}/notes) called no auth check at all. A network attacker reachable on the dashboard port could read Bluetooth tracking data and modify application state — including the heartbeat URL, prune retention, device groups, and per-device notes — without a session cookie. This issue has been patched in version 0.7.1.

An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute arbitrary shell commands on the underlying operating system.

The decompress package for Node.js before versions 10.2.2 and 11.1.4 (and the unmaintained decompress package up to 4.2.1) has a vulnerability allowing bypass of path checks via symlink chains. A crafted archive can allow reading/writing files outside the output directory, and overwriting startup scripts or configuration can lead to remote code execution.