N A CVE-2026-75411

EUVD-2026-66747

2026-08-26 mitre

GHSA-8mm6-mrr9-hg9w

Authentication Bypass N A

Lifecycle Timeline

CVE Published

Aug 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely bypassed through string concatenation and reflection.

Analysis

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in N A

View all

CVE-2026-30623 CRITICAL Act Now POC

9.8 Jul 15

Command injection in LiteLLM 1.18.10 lets attackers who can configure MCP (Model Context Protocol) servers supply arbitr

CVE-2026-67917 CRITICAL Act Now POC

9.8 Aug 17

SQL injection in AzuraCast's backup restore flow (versions up to and including 0.23.7) lets an attacker achieve privileg

CVE-2026-31072 CRITICAL Act Now POC

9.8 May 19

Remote code execution in APScheduler (all versions through 3.10.x and 4.0.0a5) is achievable when applications deseriali

CVE-2026-45185 CRITICAL Act Now POC

9.8 May 12

Remote code execution in the Exim mail transfer agent (versions before 4.99.3) built against certain GnuTLS configuratio

CVE-2025-50455 CRITICAL Act Now POC

9.1 Jul 27

SQL injection in EasyAppointments <=1.5.1 allows unauthenticated attackers to extract and modify database contents via t

CVE-2026-36356 CRITICAL Act Now POC

9.1 May 05

Unauthenticated remote OS command injection in MeiG Smart FORGE_SLT711 cellular gateway firmware MDM9607.LE.1.0-00110-ST

CVE-2026-31071 CRITICAL Act Now POC

9.1 May 19

Unauthenticated API access in LalanaChami Pharmacy Management System (commit 5c3d028) allows remote attackers to dump al

CVE-2025-66391 HIGH This Week POC

8.8 Jun 17

Privilege escalation via broken access control in Citrix Cloud (through 2025-11-10) lets a user holding only read-only p

CVE-2026-75419 HIGH This Week POC

8.8 Aug 27

go-wind-cms (GoWind) before 1.0.0 exposes all administrative APIs to any authenticated user because NewAuthorizer() retu

CVE-2026-26740 HIGH This Week POC

8.2 Mar 18

Giflib 5.2.2 contains a buffer overflow in the EGifGCBToExtension function that fails to validate allocated memory when

CVE-2025-60464 HIGH This Week POC

7.8 Jun 25

Denial of service in GPAC's MP4Box multimedia tool (versions before 26.02.0) arises from a use-after-free in the gf_sei_

CVE-2026-36355 HIGH This Week POC

7.7 May 05

Arbitrary kernel memory read/write in Realtek rtl819x Jungle SDK Wi-Fi driver allows local unprivileged attackers to acc

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

CVE-2026-75411 vulnerability details – vuln.today

Back