VulncastBriefing archive

Daily Brief - 2026-09-01

· 5 vulnerabilities · 6 min listen

▶ Listen to this briefing

CVE-2026-12894

high · CVSS 8.8 · Red Hat Quarkus

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands.

  • Code Injection
  • Remote Code Execution
  • java
  • web template engine

CVE-2026-58574

critical · CVSS 9.8 · Dell PowerStore

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full administrative access to the array.

  • Broken Authentication
  • storage appliance

CVE-2026-82692

critical · CVSS 9.9 · D-Link DNS-340L/DNS-345

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

  • OS Command Injection
  • nas firmware

CVE-2026-82854

critical · CVSS 9.8 · Nodemailer

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients. Exploitation requires the application to expose the envelope size to attacker-controlled input, as Nodemailer does not include size in the default auto-constructed envelope.

  • Command Injection
  • node.js
  • email
  • smtp

CVE-2026-82870

critical · CVSS 9.6 · ToolJet

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing organization-resolving guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.

  • Broken Access Control
  • web application
  • database