https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T17:29:49.796603+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-361239 EUVD-2026-361239 2026-10-02T17:29:49.851299+00:00 EUVD-2026-361239 https://cve.radiocsirt.org/vuln/fkie_cve-2026-76060 fkie_cve-2026-76060 2026-10-02T17:29:49.851335+00:00

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

 https://cve.radiocsirt.org/vuln/icsa-26-237-02 ICSA-26-237-02 — Zoneminder 2026-10-02T17:29:49.851369+00:00

An authenticated OS Command Injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-76060 UBUNTU-CVE-2026-76060 2026-10-02T17:29:49.851391+00:00

Affected: Ubuntu:Pro:16.04:LTS: zoneminder, Ubuntu:Pro:20.04:LTS: zoneminder, Ubuntu:Pro:22.04:LTS: zoneminder, Ubuntu:24.04:LTS: zoneminder, Ubuntu:26.04:LTS: zoneminder

An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server.