CVE-2026-3066

low · 2.1

A flaw has been found in HummerRisk up to 1.5.0. This vulnerability affects the function fixedCommand of the file hummer-common/hummer-common-core/src/main/java/com/hummer/common/core/utils/PlatformUtils.java of the component Cloud Compliance Scanning. Executing a manipulation can lead to command injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

2.1

CVSS

11.8%

EPSS (exploit prob.)

96th

EPSS percentile

2026-02-24

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-74CWE-77

Affected products

Vendor	Product	Affected versions
hummerrisk	hummerrisk	<= 1.5.0

Check a specific version with /api/v1/cve/match.

References

https://github.com/AnalogyC0de/public_exp/issues/10
https://vuldb.com/?ctiid.347417
https://vuldb.com/?id.347417
https://vuldb.com/?submit.757704

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-3066