CVE-2026-94293

The aas-edge-client REST API is vulnerable to a missing authentication flaw for critical functions. An unauthenticated remote attacker can perform PATCH requests to modify Asset Administration Shell submodel data and use GET endpoints to read all exposed data. No specific exploit details or remed...

CVE-2026-94293 Missing authentication for critical function in the aas-edge-client REST API

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints...

Exploit for CVE-2026-8206

🛡️ CVE-2026-8206: Unauthenticated Account Takeover Lab Analysi...

CVE-2026-105486

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

EUVD-2026-92916

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-105486 OSSRS srs System API api.go systemAPI.Run missing authentication

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-105486

The OSSRS srs software (up to version 7.0-a1 ) contains a vulnerability in the System API component. Specifically, the systemAPI.Run function within the internal/proxy/api.go file lacks proper authentication, allowing for remote manipulation. Public exploits for this vulnerability are currently a...

CVE-2026-105486 OSSRS srs System API api.go systemAPI.Run missing authentication

A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the component System API. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit is now public and...

CVE-2026-26980

CVE-2026-26980 ★ CVE-2026-26980 TryGhost Ghost CMS Content API SQL Injection PoC ★ https://github.com/user-attachments/assets/e7fab29e-8382-4ecc-986c-68852c28a32c Overview CVE-2026-26980 is an unauthenticated SQL Injection vulnerability in TryGhost Ghost CMS Content API. The vulnerable path is...

CLEANSTART-2026-ON00136 Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON

Security vulnerability affects the sonarqube package. Improper encoding of non-finite floating-point values during MapMessage JSON serialization in Apache Log4j API produces output that is not valid JSON...

CLEANSTART-2026-KW24127 flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint (https://www

Security vulnerability affects the sonarqube package. A flaw in Elasticsearch allows an authenticated user with the privileges required to invoke the simulate pipeline API endpoint https://www...

CVE-2026-105783

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Desktop is running with the opt-in Web Clipper server enabled, the server in packages/lib/ClipperServer.ts sends Access-Control-Allow-Origin: and allows an...

CVE-2026-105742

A flaw was found in docling. This vulnerability can lead to information disclosure of sensitive credentials, such as API keys and session tokens. When remote image fetching is enabled, the HTML image loader fails to restrict custom request headers to the document's original domain. A remote...

CVE-2026-105758

A flaw was found in vllm. An unauthenticated remote attacker can cause a Denial of Service DoS by sending requests with excessively high video processing parameters to affected API endpoints. Because the backend does not enforce upper bounds on user-controlled video frame counts and rates, the...

CVE-2026-105756

A flaw was found in vllm. An authenticated remote attacker can cause a Denial of Service DoS by submitting an API request containing an invalid cache salt parameter with forbidden characters or excessive length. Because the application fails to validate the parameter before passing it to the...

CVE-2025-71384

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

EUVD-2025-211035

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...

PT-2026-107144

Improper validation of selected CloudVision CUE application programming interface API request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability...

PT-2026-106564

In the Linux kernel, the following vulnerability has been resolved: net/sched: act api: release tail references on DELACTION failure A batched RTM DELACTION request takes a temporary reference on each action before attempting any deletion. tcf action delete clears each processed slot and drops it...

CVE-2025-71384

Dbit WIFI4 N300 1.0.0 devices allows administrators from the local Wi-Fi network to execute OS commands by leveraging a stack-based buffer overflow via the /api/addStaticDHCP comment field,...