CVE-2026-14503

The CVE-2026-14503 entry concerns the pCloud WP Backup plugin for WordPress, affected up to version 2.0.3. The root cause is a Sensitive Information Exposure via the wp2pcl_ajax_process_request_inner path. An authenticated attacker with subscriber-level access or higher can trigger generation of ...

Malicious code in dde-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f875cacd68379cbaaa066adac089dc3c403fd532a0e73ba932cf35e0562ff476 setup.py installs a telemetry.pth file into site-packages containing import telemetryinit, which causes Python's site.py to load the bootstrap module...

CVE-2026-22103

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...

EUVD-2026-43314

A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub2D568 of the component startjffs2. Performing a manipulation of the argument jffs2exec results in os command injection. Remote exploitation of the attack is possible. The exploit has be...

CVE-2026-15546

A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub2D568 of the component startjffs2. Performing a manipulation of the argument jffs2exec results in os command injection. Remote exploitation of the attack is possible. The exploit has be...

CVE-2026-22103 Command injection in NPC start web endpoint

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...

CVE-2026-22103

CVE-2026-22103 : The NPC start endpoint on the web server listening at port 8090 is vulnerable to command injection. The public CVSS v4.0 metrics indicate a base score of 9.3 (CRITICAL) with network attack vector, low attack complexity, no privileges required, and no user interaction. Impacts are...

CVE-2026-22103 Command injection in NPC start web endpoint

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...

EUVD-2026-43333

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...

CVE-2026-15546 Shibby Tomato start_jffs2 sub_2D568 os command injection

A security flaw has been discovered in Shibby Tomato up to 1.28.0000. Affected by this issue is the function sub2D568 of the component startjffs2. Performing a manipulation of the argument jffs2exec results in os command injection. Remote exploitation of the attack is possible. The exploit has be...

CVE-2026-15546

The CVE-2026-15546 entry describes a remote OS command injection in Shibby Tomato up to 1.28.0000. Affected component: start_jffs2, function sub_2D568. Exploitation involves manipulating the argument jffs2_exec; exploit is public and may be used for attacks. CVSS data indicate network access with...

PT-2026-57678

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...

CVE-2026-22103: Improper Neutralization of Special Elements used in a Command

The NPC start endpoint on the web server at port 8090 is vulnerable to command injection...

CVE-2026-15480

A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function starthttpd of the file /sbin/rc of the component Web Service. Such manipulation of the argument devicename leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is...

CVE-2026-15480

A vulnerability was identified in Trendnet TEW-635BRM up to 1.00.03. This affects the function starthttpd of the file /sbin/rc of the component Web Service. Such manipulation of the argument devicename leads to stack-based buffer overflow. The attack can be executed remotely. The exploit is...

Directory Traversal

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

Schneider Quantum 140 PLC control

Uses Modbus/TCP with Schneider Quantum proprietary function 0x5A to start or stop Schneider Quantum 140 series PLCs without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """ Schneider Quantum 140 series PLC start/stop control. Uses Schneider's proprietary Modbus extension function 0x5...

CVE-2026-47840

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselv...

CVE-2026-47840

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselv...

EUVD-2026-42518

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselv...