CVE-2026-92928

The OpenEye Apex Network Video Recorder (NVR) firmware version 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be modified, disabled, or rotated. This design flaw, present since at least firmware 2.2.3.4 , allows an unauthenticated remote attacke...

CVE-2026-92928

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account...

CVE-2026-17637

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

CVE-2026-16426

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

CVE-2026-17637

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is impacted by multiple vulnerabilities, including one that allows an adjacent-network attacker to execute arbitrary code . This flaw stems from the deserialization of untrusted data . The CVSS 3.1 score is 8.8 (High), indicating high i...

CVE-2026-17637 IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager FTM for RedHat OpenShift could allow an adjacent-network attacker to execute arbitrary code due to deserialization of untrusted data...

CVE-2026-16426

IBM Concert versions 1.0.0 through 3.0.0 are vulnerable to server-side request forgery (SSRF) . This vulnerability allows an authenticated attacker to initiate unauthorized requests from the system, which may result in network enumeration or the facilitation of additional attacks. No specific rem...

CVE-2026-16426 Multiple Vulnerabilities in IBM Concert Software

IBM Concert 1.0.0 through 3.0.0 is vulnerable to server-side request forgery SSRF. This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks...

MAL-2026-16410 Malicious code in auclean (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 535d1083af63653f3cc6befeffe23a6fd97cea9b183b95eac92779a5abcdcd9d The pip install of auclean 0.4.2 runs a custom setup.py buildpy command that chmod 0755's and executes a 1.8MB bundled Rust ELF binary...

Home Assistant: mDNS Server-Side Request Forgery

Summary Home Assistant Green is vulnerable to a Server-Side Request Forgery SSRF via the mDNS/Zeroconf IPP integration. An unauthenticated attacker on the local network can send a crafted mDNS response to trick Home Assistant into making HTTP requests to arbitrary hosts, including internal servic...

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

CVE-2026-96259

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, and 11.10.x

CVE-2019-0708-Batch-Blue-Screen

CVE-2019-0708-Batch-Blue-Screen Modified version of a blue screen script by an expert, changed to batch blue screen for a network segment. Usage: root@kitploit: python3 poc.py 192.168.20 64 Batch attacks hosts 1-255 in the 192.168.20 network segment to cause blue screens. Modify accordingly based...

OpenCVE: Server-Side Request Forgery (SSRF) in notifications

Impact OpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations. An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...

GHSA-CH3G-4XVR-674Q OpenCVE: Server-Side Request Forgery (SSRF) in notifications

Impact OpenCVE contains a Server-Side Request Forgery SSRF vulnerability in the notification testing functionality for both Webhook and Slack integrations. An authenticated user with permission to configure notification channels can trigger test requests to arbitrary HTTPS endpoints. Insufficient...

HeartBleed

HeartBleed vulnerability in docker 1. git clone https://github.com/Saymeis/HeartBleed.git 2. cd HeartBleed 3. sudo docker build -t heartbleed -f Dockerfile . 4. sudo docker run -p 80:80 -p 443:443 -d heartbleed...

GHSA-M8F5-RH7H-VGG3 microsandbox: Secret values exposed in world-readable process arguments

Summary When the SDK spawns a sandbox, the msb sandbox child process receives the full network configuration as an inline --network-config command-line argument, and any per-sandbox environment as repeated --env KEY=VALUE arguments. On Linux a process's arguments are world-readable via...

CVE-2026-95861

A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-95862

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service DoS attack on the device...

CVE-2026-91129

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automatically processed unauthenticated ipp.tcp.local mDNS announcements in homeassistant/components/ipp/configflow.py, where asyncstepzeroconf passed...