Cpe:2.3:a:zoneminder:zoneminder:*:*:*:*:*:*:*:*

An authenticated OS command injection vulnerability (CVE-2026-102608) in ZoneMinder versions prior to 1.38.3 allows remote code execution via unsanitized monitor names during event export operations.