CVE-2026-49921

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4_20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulating the GPS or PPS serial port parameter, an attacker with access to the NTP configuration can escape the intended directory and write user-controlled data to any file.

The Auth0 AD/LDAP Connector is vulnerable to stored Cross-Site Scripting (XSS) issues due to improper HTML encoding of data in search results and updater log content displayed in the admin panel. An authenticated user with privileges to modify directory attributes, or a low-privileged local user on the host, could insert script content that executes in an administrator's browser.

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

In Eclipse Ditto's Node.js JavaScript client, all released versions of @eclipse-ditto/ditto-javascript-client-node from 2.0.0 to 3.9.0 and of its predecessor package @eclipse-ditto/ditto-javascript-client-node_1.0 from 1.0.0 to 2.1.0, the WebSocket transport hard-codes rejectUnauthorized: false when creating the underlying ws WebSocket. Certificate chain and hostname validation are disabled for every wss:// connection, with no builder option, constructor argument, or environment variable to enable it. An attacker intercepting the connection can present an arbitrary certificate, complete the TLS handshake, read credentials sent in the Authorization header, and read, alter, or inject Ditto Protocol messages.

ColdFusion is affected by an SQL Injection vulnerability that could result in arbitrary code execution in the context of the current user. An attacker with high privileges could exploit this to execute arbitrary code. Exploitation does not require user interaction and the scope is changed.

In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local information disclosure without additional execution privileges. User interaction is not needed.

ColdFusion is affected by an Eval Injection vulnerability that could result in arbitrary code execution in the context of the current user. A low-privileged attacker could exploit this to execute arbitrary code. Exploitation does not require user interaction and the scope is changed.

In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege without additional execution privileges. User interaction is not needed.

Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. A low-privileged attacker could exploit this. Exploitation does not require user interaction and the scope is changed.

Adobe Campaign Classic (ACC) is affected by an OS Command Injection vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this to execute arbitrary code. Exploitation does not require user interaction and the scope is changed.