168118 matches found
EUVD-2026-58274
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...
CVE-2026-18164 Flow Neuroscience FL-100 Use of Hard-coded Credentials
An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state...
CVE-2026-73669
The CVE describes a vulnerability in Signify Philips Hue Bridge Pro: its Mosquitto MQTT broker (v2.0.22) runs on all interfaces with anonymous access and no firewall restrictions. This allows an attacker on the Bridge’s network to read device data and control connected lights. No remediation deta...
EUVD-2026-58238
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...
CVE-2026-17223
IBM i (7.3–7.6) is affected by CVE-2026-17223 among others. The vulnerability is a buffer overflow that could allow a remote authenticated attacker to execute arbitrary code. Affected: IBM i releases 7.3, 7.4, 7.5, 7.6 on host servers; related issues include DoS and information disclosure in othe...
CVE-2026-16929
IBM i is affected by CVE-2026-16929 among multiple host-server vulnerabilities. Affected products and versions: IBM i 7.3–7.6. Description indicates a buffer overflow that could allow a remote authenticated attacker to obtain sensitive information. The IBM security bulletin lists related CVEs and...
CVE-2026-17220
IBM i 7.3–7.6 is affected by CVE-2026-17220, a buffer overflow in host servers that could allow a remote attacker to cause a denial of service and modify authentication metadata. The vulnerability is described in IBM’s Security Bulletin, which lists the affected releases and associated fixes. Rem...
CVE-2026-17220 IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...
EUVD-2026-58231
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...
CVE-2026-17220 IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service and modify authentication metadata due to a buffer overflow...
CVE-2026-17197 IBM i is Affected By Multiple Vulnerabilities in Host Servers
IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of client-asserted identity...
CVE-2026-73481 phpList < 3.7.0-RC5 Cross-Site Request Forgery via Bounce Rules
phpList before 3.7.0-RC5 fail to enforce CSRF token validation on the bounce rule deletion endpoint bouncerules.php / bouncerule.php. The deletion is performed via a GET request ?page=bouncerules&del=N, and the central CSRF check verifyCsrfGetToken is invoked with enforce=false, so it only...
CVE-2019-25765
creationtimestamp| type| source ---|---|--- 2026-08-13 18:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eio7hnpnmjbon 2026-08-14 14:00:30+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b6890fd9-837f-4a64-a1fa-c036ecba0806...
vLLM: Completion prompt lists fan out into unbounded engine requests
Summary The /v1/completions request model accepts prompt as a list of text prompts or a list of token-id prompts without any outer prompt-count bound. The serving path turns each element into a separate engine input, creates one engine generator per element, merges all generators, and allocates a...
CVE-2026-18428
A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint...
EUVD-2024-55719
Hongjing e-HR contains an unauthenticated SQL injection vulnerability in the getSdutyTree servlet endpoint that allows remote unauthenticated attackers to access protected resources by supplying a path traversal sequence in the request URI to bypass the oauthservlet authentication filter. Attacke...
CVE-2026-58508
Two SSRF vulnerabilities in Gitea migration/mirror DNS rebinding + missing re-validation...
CVE-2026-55987
OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...