CVE-2026-12195

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can insert arbitrary commands as a part of the v_ftp_user parameter when deleting FTP usernames. This could result in the execution of commands as the admin user or takevoer of the admin user in myVesta.

• CWE-78

• https://github.com/myvesta/vesta/commit/95d7e43bf286d6881ca753dac93cb42d98cc7422
• https://projectblack.io/blog/local-ai-for-cyber-security/#myvesta-authenticated-rce

Published

Jul 4, 2026

Last Modified

Jul 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1219The MP3 Audio Player – Music Player, Podcast Player & Radio …5.3
• CVE-2026-12190A vulnerability has been found in Genspark AI Workspace App …5.3
• CVE-2026-12191A vulnerability was found in Comma AI Openpilot 0.11. This i…7.8
• CVE-2026-12192A vulnerability was determined in GALAYOU Y4 1.0.0. Impacted…8.8
• CVE-2026-12193A vulnerability was identified in VS Revo RevoUninstaller 2.…7.8
• CVE-2026-12194PHPIPAM is affected by an authenticated local file inclusion…2.3
• CVE-2026-12196HestiaCP panel cronjob feature is affected by a broken acces…8.3
• CVE-2026-12197A security flaw has been discovered in Ruijie EG105G-P 2.340…7.3
• CVE-2026-12198A weakness has been identified in Microweber up to 2.0.20. T…7.3
• CVE-2026-12199A vulnerability in `nltk.app.wordnet_app` up to version 3.9.…7.5
• CVE-2026-1220Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a…7.5
• CVE-2026-12200A security vulnerability has been detected in Ritlabs TinyWe…7.3