By weakness (CWE)

CWE-489: related vulnerabilities

CVEs classified under CWE-489. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

5 published vulnerabilities

• CVE-2026-58378HIGH 8.8

  The Allwinner H616 TV Box TV98 ships with Android Debug Bridge (ADB) enabled and accessible over the network in production deployments. An attacker on the network can request ADB authorization and, if the user grants access, obtain complete root-level control of the device. This is a network-exposed debug interface that should never be enabled in consumer products.

• CVE-2026-59092HIGH 7.7

  JuiceFS versions up to 1.3.1 contain a critical flaw that leaves debug and metrics endpoints exposed without authentication. An attacker can access these endpoints to retrieve sensitive information—including database credentials embedded in process command lines—that grants them full control over the filesystem's metadata layer. This vulnerability also enables information disclosure about internal system state and can be exploited to disrupt service availability.

• CVE-2026-54799MEDIUM 6.7

  A flaw in the firmware update mechanism of CPCI85 Central Processing/Communication and SICORE Base system allows attackers with administrative access to bypass signature validation and install malicious firmware. Successful exploitation results in persistent code execution on the affected device, meaning the compromise survives reboots and cannot be easily removed. Organizations running versions prior to V26.20 should treat this as a significant integrity risk, particularly in critical infrastructure or sensitive operational environments.

• CVE-2026-54798MEDIUM 6.5

  CPCI85 and SICORE Base system versions before 26.20 contain an exposed debugging interface accessible over the network that can be reached by authenticated users. An attacker with valid credentials could exploit this interface to crash the web process, causing the system to become unavailable. This is a denial-of-service vulnerability affecting industrial control and communication systems.

• CVE-2026-58191MEDIUM 6.5

  Appium's base-driver component has a reflected cross-site scripting (XSS) vulnerability affecting versions prior to 10.7.0. The vulnerability exists in three built-in test routes that unconditionally mount without restriction. When users visit these endpoints, the application reflects unsanitized input from query parameters, POST fields, and HTTP headers directly into the HTML response. An attacker can craft a malicious link or form that executes arbitrary JavaScript in the victim's browser within the Appium server's origin, potentially compromising sessions or sensitive data accessible to that context.