CVE-2026-66050
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk51th percentile - higher than 51% of all known CVEs
Summary
A path traversal vulnerability in NitroShare Desktop up to version 0.3.4 allows unauthenticated attackers on the same LAN to write files outside the transfer directory. Attackers can place files in the Windows Startup folder, enabling persistent code execution.
Risk Assessment
An attacker on the local network can achieve persistent code execution on the victim's machine, potentially leading to system compromise and data theft.
Recommendation
Update NitroShare Desktop to the latest version. Limit trust to devices on the local network and use firewalls.
Related vulnerabilities
- CVE-2026-82616Critical
A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703 in the setUploadSetting function of /cgi-bin/cstecgi.cgi. Manipulation of the FileName argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been made public.
- CVE-2026-77956Critical
A code injection vulnerability in ash-project ash_ai allows a remote, unauthenticated client to execute arbitrary Elixir code. AshAi.Actions.Prompt evaluates prompt content through EEx.eval_string/2, and when prompt content incorporates request data, attacker-controlled text is compiled and run as an EEx template. This affects ash_ai from 0.1.0 before 1.0.0.
- CVE-2026-82593Critical
A flaw was found in D-Link DIR-825M 1.1.8 in the sub_41802C function of /boafrm/formLtefotaUpgradeFibocom, related to LTE module firmware upgrade. Manipulation of the fota_url argument causes a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been published.
- CVE-2026-82592Critical
A vulnerability was detected in D-Link DIR-825M 1.1.8. It affects the function sub_46725C in the file /boafrm/formDiskFormat of the Disk Formatting Handler Endpoint. Manipulation of the argument partition results in a stack-based buffer overflow. The attack can be executed remotely, and the exploit is public.
- CVE-2026-82542Critical
A vulnerability in Tenda HG10 300001138 affects the formIPv6Routing function in the file /boaform/admin/formIPv6Routing of the Boa Web Server component. Manipulation of the destNet argument causes a buffer overflow. The attack can be carried out remotely, and the exploit is publicly available.
- CVE-2026-82539Critical
A vulnerability was identified in TOTOLINK A720R 4.1.5cu.630_B20250509, affecting the setMacFilterRules function in cstecgi.cgi of the MAC Filtering component. Manipulating the desc argument can lead to memory corruption. The attack can be launched remotely, and the exploit has been publicly disclosed.
- CVE-2026-15980Critical
The MyHome Core plugin for WordPress up to version 4.4.5 contains an authentication bypass vulnerability. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This allows unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators.
- CVE-2026-15369Critical
The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persisting it in order meta, and then passing it directly to WP_User::add_role() without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator as the desired role.
- CVE-2026-82460Critical
Cloud Commander before version 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.
- CVE-2026-82456Critical
argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.
Original NVD description (English source)
NitroShare Desktop through 0.3.4 contains a path traversal vulnerability in its LAN file transfer server that allows unauthenticated attackers on the same network to write arbitrary files by sending a crafted filename containing directory traversal sequences in the JSON item header name field. Attackers can exploit the lack of path validation to write files outside the transfer root directory to arbitrary locations the current user has write access, including the Windows Startup folder, enabling persistent code execution on the next user login.