CVE-2026-59177

ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the "Home Assistant" add-on's trusted "ingress" site binds to "0.0.0.0" while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests...

EUVD-2026-112060

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369 Waline login accepts a non-string email as a match-all MongoDB query

Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string for example a JSON object such as...

CVE-2026-55369

The comment system Waline is vulnerable to a partial authentication bypass in versions prior to 1.41.1 . The POST /api/token login endpoint fails to validate the type of the email field in the request body. When a non-string value (e.g., a JSON object like `{

CVE-2026-86426

LibreNMS CVE-2026-86426 - Full Audit & Recon Tool 📌 Description This tool is a Proof of Concept PoC and reconnaissance framework for the vulnerability CVE-2026-86426 Authentication Bypass via Type Confusion in LibreNMS. It demonstrates how an unauthenticated attacker can: 1. Bypass API...

ministore-sqli-ctf

MiniStore — SQL Injection CTF Lab ⚠️ TUYÊN BỐ GIÁO DỤC /...

CVE-2026-42533

CVE-2026-42533 — nginx two-pass capture clobbering Pre-auth heap overflow + info leak in nginx 0.9.6–1.30.3 / mainline ≤1.31.2 complex-value script engine; CVSS 9.2. Two trigger surfaces share the same root cause: HTTP regex location + regex map and stream sslpreread + SNI + regex map. In-depth...

CVE-2026-115223

The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text block and later evaluated by its template engine, because the filter meant to strip template delimiters runs before a decoding step that reconstructs them,...

CVE-2026-101272

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referre...

CVE-2026-103779

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privilege...

CVE-2025-30414

Local privilege escalation due to improper authentication. The following products are affected: Acronis Cyber Protect Cloud Agent Windows before build 42569, Acronis Cyber Protect 17 Windows before build 42587...

EUVD-2026-111999

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referre...

Vulnerabilities have been addressed in Cisco Secure Firewall ASA, Threat Defense, and Management Center

Cisco has addressed vulnerabilities in the Secure Firewall ASA, Threat Defense, and Management Center software products. Cisco has categorized these vulnerabilities into eight distinct vulnerability classes CWE, assigning each a unique CVE identifier. The vulnerabilities involve various security...

CVE-2026-103779

Dell PowerProtect Data Domain software versions 7.7.1.0 through 8.8 (Feature Release), 7.13.1.0 through 7.13.1.80 (LTS2024), 8.3.1.0 through 8.3.1.40 (LTS2025), and 8.6.1.0 through 8.6.1.20 (LTS2026) are vulnerable to an Improper Authentication vulnerability (CWE-287 ). A low privileged attacker ...

CVE-2026-103779

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privilege...

EUVD-2026-111994

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privilege...

CVE-2026-103779

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Authentication vulnerability. A low privilege...