Exploit for CVE-2026-58115

node-red-scanner Local triage for CVE-2026-58115, the 10...

OpenMRS Platform < 2.24.0 - Insecure Object Deserialization

OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. id: CVE-2018-19276 info: name: OpenMRS Platform 2.24.0 - Insecure Object...

ZyXel USG - Hardcoded Credentials

A hardcoded credential vulnerability was identified in the 'zyfwp' user account in some Zyxel firewalls and AP controllers. The account was designed to deliver automatic firmware updates to connected access points through FTP. id: CVE-2020-29583 info: name: ZyXel USG - Hardcoded Credentials autho...

Vite Development Server - Path Traversal

Path traversal vulnerability in Vite development server's @fs endpoint allows attackers to access files outside the intended directory. When exposed to the network, attackers can exploit this via crafted URLs to access sensitive system files. id: CVE-2025-31125 info: name: Vite Development Server...

JBoss JMX/Web Console - Authentication Bypass via HTTP Verb Tampering

JBoss EAP 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 only enforce authentication for GET/POST on the JMX and Web consoles because the web.xml security-constraint enumerates only those verbs in . Non-standard verbs such as HEAD skip the constraint, granting unauthenticated access to MBean...

Roxy-WI < 6.1.1.0 - Remote Code Execution

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. id: CVE-2022-31137 info: name: Roxy-WI 6.1.1.0 - Remote Code Execution author:...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account

The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...

Apache Shiro 1.2.4 Cookie RememberME - Deserial Remote Code Execution Vulnerability

Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbitrary code or bypass intended access restrictions via an unspecified request parameter. id: CVE-2016-4437 info: name: Apache Shiro 1.2.4 Cookie RememberME -...

MeterPwrShell

Inactive Tool - Reason : busy with something else . . . / \ / | \ \ / /| | | | | | \ \ / \ / / \ / \ \ | / / | \ \ | | / | | | | / / / Y \ /| | \ /| | / | \ / | | / | Y \ /| || |/ \ | /\ | \ | || // || / /|| /\ /| \ / / / / / / / MeterPwrShell2 Automated Tool That Generate A...

CVE-2026-82154: Dell OS Recovery tool: Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability

Dell OS Recovery tool versions, prior to 2.4.4, contain a use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with physical access could potentially exploit this vulnerability, leading to Information Disclosure...

CVE-2026-121423: surrealdb: SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the…

SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it,...

CVE-2026-65168: NVIDIA Slurm: NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code...

CVE-2026-121030: Google Chrome: Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-108059: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality

A stored Cross-Site Scripting XSS vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation require...

CVE-2026-121411: FreeRDP: FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX…

FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX MAPSURFACETOSCALEDOUTPUT PDUs, allowing malicious RDP servers to abort X11 clients. Attackers can map a surface to oversized scaled output, triggering checked UINT16 cast or freerdpimagescale stride...

CVE-2026-121159: Google Chrome: Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…

Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. Chromium security severity: Low...

CVE-2026-121455: dbgate: DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated…

DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated users to bypass LOGINPERMISSIONS because test and save never call testConnectionPermission. Attackers can submit arbitrary connection definitions to POST /connections/test to probe...

CVE-2026-99251: Linux: In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in…

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in initvpindex There is a retry loop in initvpindex where the CPUs from a certain node are stripped out if they have already been in the allocated cpumask or not in HKTYPEMANAGEDIRQ...

CVE-2026-77691: Zohocorp ManageEngine Key Manager Plus: ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when…

ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA...

CVE-2026-121555: DrizzleTime Foxel: Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files…

Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all...