VulnForge

VulnForge 漏洞与利用情报工具 | Nebula Forge 检测套件 v2 VulnForge 从 ExploitDB、NVD 和 Metasploit 聚合利用情报，将发现结果映射到 MITRE ATT&CK 技术，并将结果直接输入 Nebula Forge 紫队流水线——通过一次搜索即可生成狩猎剧本、LogNorm 就绪导出以及 AtomicLoop 模拟触发器。 概述 VulnForge 弥合了漏洞发现与检测工程之间的差距。搜索 CVE 或关键词，获取映射到 ATT&CK 技术的利用数据，然后将该上下文向下游推送——直接送入 HuntForge 生成剧本，或送入...

CVE-2026-78862

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board PCB...

CVE-2026-78861: Undefined Security Weakness

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-78862

An issue in the Mercusys AC12 V2 hardware allows a local attacker to achieve arbitrary code execution . This vulnerability is triggered via the UART serial interface located on the device's printed circuit board (PCB) . No specific software versions, remediation steps, or exploit links are provid...

EUVD-2026-92786

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-78862: Undefined Security Weakness

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board PCB...

EUVD-2026-92785

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-78860

The Mercusys AC12 V2 is affected by a vulnerability that allows a local attacker to achieve arbitrary code execution . The root cause is identified as the storage of information in plaintext , which is associated with CWE-311 (Missing Encryption of Sensitive Data) and CWE-347 (Improper Verificati...

CVE-2026-78861

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-78861

The Mercusys AC12 V2 is vulnerable to a flaw where a local attacker can execute arbitrary code . This vulnerability is caused by the inclusion of a hardcoded 512-bit RSA Private Key within the device. While the CVSS 3.1 score is 7.7 (High) , indicating high impact on confidentiality and integrity...

PT-2026-106221

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

PT-2026-106192

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-78860: Undefined Security Weakness

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

CVE-2026-78861

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key...

CVE-2026-78860

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext...

EUVD-2026-92784

An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board PCB...

CVE-2026-105633: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issueid in the URL but omits it from the database query. A project member can use an issueid they control in the URL while targeting another user's attachment by its pk UUID. Because th...

PT-2026-106028

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspace slug/download/asset id/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belong...

CVE-2026-105637: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retrieves assets using idin=assetids and workspaceslug=slug but does not constrain the query with projectid from the URL. A workspace Guest can provide asset UUID...