Cacti (< 1.2.31) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/cacti--1.2.31/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 15:43:15 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCacti: Input validation bypass in command blocklist (CVE-2026-39902)https://feed.craftedsignal.io/briefs/2026-10-cacti-command-injection/Fri, 23 Oct 2026 15:43:15 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-cacti-command-injection/Cacti versions prior to 1.2.31 contain an input validation bypass in the command blocklist, allowing an authenticated administrator to pass restricted characters.<p>Cacti, an open source performance and fault management framework, contains an input validation bypass in versions prior to 1.2.31. The blocklist omitted single-quotes, double-quotes, redirect operators, subshell parentheses, and braces. An authenticated administrator could save an input_string containing single-quotes, redirect operators, or subshell parentheses, and pass the security check. This issue has been patched in version 1.2.31.</p> highadvisory