CVE-2026-75337: Improper Limitation of a Pathname to a Restricted Directory

The static resource interface /api/static/deployKey/ of Yu AI Code Mother v4.3 is vulnerable to path traversal. The user-controlled path is concatenated to the preview root directory without any normalization, allowing anonymous attackers to read files outside the preview root...

CVE-2026-73630: Observable Discrepancy

SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/filetree/authFilePublishAccess endpoint, which is registered with CheckAuth only and is reachable anonymously. The endpoint never sets a failure code, so its outcome is signalled entirely by the response message and...

AVideo Meet plugin: anonymous-to-admin stored XSS via unescaped participant User-Agent in getMeetInfo.json.php Participants panel

Summary The Meet plugin stores the raw HTTP User-Agent header of every meeting participant and later renders it without output encoding in the meeting-management "Participants" panel that the meeting host and site administrators open. An anonymous, unauthenticated attacker can join any public...

CVE-2025-66336: Improper Neutralization of Special Elements used in an SQL Command

Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL query, and the query is executed without passing the caller's authorization context. This may allow an authenticated attacker, or an anonymo...

CVE-2026-41147

NukeViet CMS is a multi Content Management System. Versions 4.5.07 and prior contain a Stored Cross-Site Scripting XSS vulnerability caused by insufficient server-side input sanitization in the Request class. The application relies primarily on client-side filtering to sanitize HTML tags and...

CVE-2023-43816

A buffer overflow vulnerability exists in Delta Electronics Delta Industrial Automation DOPSoft version 2 when parsing the wKPFStringLen field of a DPS file. An anonymous attacker can exploit this vulnerability by enticing a user to open a specially crafted DPS file to achieve code execution...

EUVD-2018-2919

Malware in sbrugna...

EUVD-2023-47907

Malicious code in bioql PyPI...

CVE-2025-55171 WeGIA Anonymous Attacker can Delete Arbitrary Image file at endpoint `/html/personalizacao_remover.php`

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check authentication at endpoint /html/personalizacaoremover.php allowing anonymous attacker without login to delete any Image files at endpoin...

CVE-2025-55171: Improper Authentication

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, the application does not check authentication at endpoint /html/personalizacaoremover.php allowing anonymous attacker without login to delete any Image files at endpoin...

CVE-2024-3279

An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint. This vulnerability allows an anonymous attacker, without an account in the application, to import their own database file, leading to the deletion or spoofing of...

CVE-2024-23615

A buffer overflow vulnerability exists in Symantec Messaging Gateway versions 10.5 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as root...

Symantec Messaging Gateway Security Vulnerability

Symantec Messaging Gateway is a suite of spam filters from Symantec USA. The product features anti-spam, anti-virus, advanced content filtering, and data leakage protection. A security vulnerability exists in Symantec Messaging Gateway version 9.5 and earlier. A remote anonymous attacker can...

PT-2024-1418 · Delta Electronics · Ispsoft

Name of the Vulnerable Software and Affected Versions: Delta Electronics ISPSoft affected versions not specified Description: A heap buffer-overflow exists in Delta Electronics ISPSoft, allowing an anonymous attacker to exploit this issue by enticing a user to open a specially crafted DVP file,...

CVE-2023-40145

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device...

CVE-2023-38584 Weintek cMT3000 HMI Web CGI Stack-based Buffer Overflow

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin commandwb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication...

CVE-2023-40145: Improper Neutralization of Special Elements used in an OS Command

In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device...

CVE-2023-38584: Stack-based Buffer Overflow

In Weintek's cMT3000 HMI Web CGI device, the cgi-bin commandwb.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypass login authentication...

PT-2023-6284 · Weintek · Cmt3000 Hmi Web Cgi

Name of the Vulnerable Software and Affected Versions: Weintek cMT3000 HMI Web CGI affected versions not specified Description: The issue is related to a stack-based buffer overflow in the cgi-bin codesys.cgi of Weintek's cMT3000 HMI Web CGI device. This could allow an anonymous attacker to hijac...

Weintek cMT Buffer Error Vulnerability

Weintek cMT is a human machine interface application from Weintek. A security vulnerability exists in the Weintek cMT3000 HMI Web CGI, which stems from the fact that cgi-bin codesys.cgi contains a stack-based buffer overflow, which could allow an anonymous attacker to hijack control flow and bypa...