Patch bypass: unauthenticated remote code execution via encoded-separator filter evasion
KestraOpen-source orchestration platform
Remote code executionDisclosed Oct 6, 2026
CVE Discoveries
Vulnerabilities,
responsibly disclosed.
Explore vulnerabilities discovered and responsibly disclosed by OPSWAT Unit 515.
Disclosure Overview13 CVEsacross 9 vendors
CVEs discovered by OPSWAT Unit 515
Coordinated disclosureCVE-2026-30860Critical · 10.0
Validation bypass in PostgreSQL array and row expressions of the database query feature
WeKnoraLLM document understanding framework
Remote code executionDisclosed Mar 9, 2026
CVE-2026-28229Critical · 9.1
Authorization bypass in WorkflowTemplate endpoints
Argo WorkflowsKubernetes workflow engine
Secret disclosureDisclosed Mar 11, 2026
CVE-2026-30855High · 8.8
Authorization bypass in tenant management endpoints
WeKnoraLLM document understanding framework
Cross-tenant accessDisclosed Mar 6, 2026
CVE-2026-102369High · 8.7
Command injection in the MacTool handler of the TMPD service
TP-LinkTapo C200 V5, Tapo C120 V1
OS command executionDisclosed Oct 1, 2026
CVE-2026-15315High · 8.7
Authentication bypass via replay in the local management interface
TP-LinkHome security camera
Admin session hijackDisclosed Aug 18, 2026
CVE-2026-40967High · 8.6
Improper escaping in vector store FilterExpressionConverter implementations
Spring AIVector store filters
Query injectionDisclosed Apr 27, 2026
CVE-2026-68894High · 8.0
Windows Error Reporting elevation of privilege
MicrosoftWindows, Windows Server
Elevation of privilegeDisclosed Sep 8, 2026
CVE-2026-15316Medium · 6.5
Insufficient input validation during Wi-Fi onboarding
TP-LinkHome security camera
Denial of serviceDisclosed Aug 18, 2026
CVE-2026-20110Medium · 6.5
Privilege escalation chain to maintenance mode
CiscoEnterprise access switch
Persistent DoSDisclosed Mar 25, 2026