CVE-2026-104286

A use of hard-coded cryptographic key vulnerability in Johnson Controls EasyIO FS32 allows retrieval of embedded sensitive data. This issue affects EasyIO FS32 versions before 3.0b63.

This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an attacker-controlled web page and the native host, allowing malicious input to bypass security checks.

Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) contain hardcoded passwords in access control. Remote unauthenticated attackers can read them from firmware or documentation and access/reconfigure the robots.

Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) have unvalidated pathnames in the web interface. Remote unauthenticated attackers can use path traversal to read configuration and security parameters.

In GetSimple CMS CE prior to version 1.5, the UpdateCE update form lacked an anti-CSRF token and the POST handler did not verify token or request origin. A remote attacker can host a page that auto-submits a forged POST; when an authenticated admin visits it, the server performs an attacker-directed download-and-deploy operation, leading to remote code execution. The url field is also written unescaped, allowing HTML injection.

In GetSimple CMS CE prior to version 1.5, the update handler in UpdateCE.php downloads a ZIP archive and extracts it into the web root without validating file types or extraction paths. Because PHP files are written into a web-accessible directory, an attacker who can cause a malicious archive to be processed achieves remote code execution as the web-server user. Entry names are also used unsafely, allowing directory traversal (../) to write files outside the intended directory.

Teledyne FLIR Aware2 versions through 6.9.0.2 transmit data in cleartext in primary control endpoints. Remote unauthenticated attackers can intercept, hijack, or modify session traffic against PackBot robots via sniffing or hijacking network traffic.

The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could send a GET request and trigger an unhandled exception, causing Laravel to expose the entire server environment, including all .env configuration variables, in plaintext. Fixed on or before 2026-09-02.

DHIS2 versions from 2.42.0 to before 2.42.5.1, and from 2.43.0 to before 2.43.0.1, are vulnerable to remote code execution (RCE) via unsafe Java deserialization. This issue has been patched in versions 2.42.5.1, 2.43.0.1, and 2.44.

Capacitor versions from 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1 have a vulnerability in the Android and iOS WebView navigation guard: it validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. Fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.