CVE-2026-9085
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk1th percentile - higher than 1% of all known CVEs
Summary
A vulnerability in Pardus-Parental-Control allows DNS spoofing due to incorrect permission assignment for critical resources and improper access control. The issue affects versions up to and including 0.5.1, before 0.7.0.
Risk Assessment
An attacker can redirect the victim's DNS traffic, leading to data interception, phishing, or other man-in-the-middle attacks.
Recommendation
Immediately update Pardus-Parental-Control to version 0.7.0 or later.
Related vulnerabilities
- CVE-2026-85509Critical
FreeIPMI before version 1.6.19 contains a stack-based buffer overflow in the _read_fru_data function in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.
- CVE-2026-85508Critical
The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _output_dell_system_info_cmc_ipv6_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the cmc-ipv6-info subcommand of dell get-system-info.
- CVE-2026-85507Critical
The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _output_dell_system_info_cmc_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the cmc-info subcommand of dell get-system-info.
- CVE-2026-85506Critical
The ipmi-oem tool in FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _get_dell_system_info_idrac_info function in ipmi-oem/ipmi-oem-dell.c, triggered by the idrac-info subcommand of dell get-system-info.
- CVE-2026-85504Critical
FreeIPMI before version 1.6.19 has a stack-based buffer overflow in the _ipmi_sel_oem_fujitsu_get_sel_entry_long_text function in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c, triggered by malformed Fujitsu SEL long-text responses.
- CVE-2026-11613Critical
The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 5.1.2 via the 'custom_loop_template' parameter. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling execution of any PHP code in those files. The vulnerability is only exploitable when the loop_templates parameter is set to 'custom-template'.
- CVE-2026-85148Critical
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts.
- CVE-2026-85146Critical
SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code.
- CVE-2026-75754Critical
ASUS Control Center has vulnerabilities: Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials. An unauthorized user can obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with hardcoded credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company.
- CVE-2026-67402Critical
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
Original NVD description (English source)
Incorrect Permission Assignment for Critical Resource, Improper Access Control vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-Parental-Control allows DNS Spoofing. This issue affects Pardus-Parental-Control: from <=0.5.1 before 0.7.0.