62421 matches found
CVE-2026-38059 ST Engineering iDirect iQ-Series Terminals Missing authentication for critical function
The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including the serial number, Device ID DID, Terminal Private Key identifier TPK, MAC address, and exact firmwa...
CVE-2026-56254 capacitor-updater - End-to-End Encryption Bypass via Private Key Distribution
In @capgo/capacitor-updater Cap-go/capgo before 12.128.2, the end-to-end encryption scheme distributes the private key to each device that downloads the app. Because the public key can be derived from the private key, an attacker performing a man-in-the-middle attack or compromising the Capgo...
MINI-GW36-HCJ6-QWF7
Bulletin has no description...
MINI-G68C-3XM6-QPQP
Bulletin has no description...
MINI-V24M-X4MX-RP6P
Bulletin has no description...
MINI-488P-56V5-M2CV
Bulletin has no description...
MINI-M74R-WM32-V8WG
Bulletin has no description...
MINI-736P-J83H-72VQ
Bulletin has no description...
Malicious code in dowload_ebok_programming_in_haskell_second_edition_by_graham_hutton_c19wm (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ab15ed01b9b4270e5605dcbb6ab8185f8b3501615c5f122a82d41deb14a7bff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
From 17,000 to 1.1 Million Assets: How Lumen Technologies Rebuilt Exposure Management at Scale
Most enterprises assume their asset inventory is close enough to accurate. The evidence suggests otherwise. According to a survey of over 600 security leaders in the 2026 Axonius Actionability Report, only 45% of organizations consolidate their asset and exposure data into a single view, and ever...
DNP3 integrity poll
Performs read-only DNP3 integrity-style polls: device attributes, binary inputs, binary output status, and analog inputs. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from lib.protocols.ics.dnp3client import...
Malicious code in nodemon-slint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5488028be686500c0af6b7f91ead55be9ddaeb86f3b920fce7eed6f8111b0050 Package name, README, homepage nodemon.io, author remy, and source tree are copied verbatim from the widely-used 'nodemon' package, with the addition...
USN-8492-5: Linux kernel (FIPS) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; -...
MINI-C86R-2VPR-835V
Bulletin has no description...
MINI-M97F-436G-XJMM
Bulletin has no description...
CVE-2026-21056
Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...
CVE-2026-15291
The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/id. This is due to the plugin not performing any...
CVE-2026-21056
Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...
CVE-2026-21056
Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information...
CVE-2026-21056
Samsung Health before version 7.00.0.107 has an improper authorization flaw that enables local attackers to access information on connected devices. The issue is limited to local access with low privileges per the CVSS metrics, and the impact is confined to confidentiality of connected-device inf...