AZIOT 1 Node Smart Switch 安全漏洞

AZIOT 1 Node Smart Switch is a single-node intelligent switching device developed by the Indian company AZIOT. Version 1.1.9 of AZIOT 1 Node Smart Switch contains a security vulnerability. This vulnerability stems from improper access control of the UART debugging interface, which may allow...

CVE-2026-30613

An information disclosure vulnerability exists in AZIOT 1 Node Smart Switch 16amp- WiFi/Bluetooth Enabled Software Version: 1.1.9 due to improper access control on the UART debug interface. An attacker with physical access can connect to the UART interface and obtain sensitive information from th...

CVE-2026-35174: Improper Limitation of a Pathname to a Restricted Directory

Chyrp Lite is an ultra-lightweight blogging engine. Prior to 2026.01, a path traversal vulnerability exists in the administration console that allows an administrator or a user with Change Settings permission to change the uploads path to any folder. This vulnerability allows the user to download...

chyrp-lite 代码问题漏洞

Chyrp-Lite is a self-hosted blog and website platform developed by Daniel Pimley. Versions of Chyrp-Lite prior to version 2026.01 contained code vulnerabilities. These vulnerabilities stemmed from path traversal vulnerabilities in the management console, which could lead to arbitrary file downloa...

org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation

An improper input neutralization flaw has been discovered in Apache Tomcat. Tomcat did not escape ANSI escape sequences in log messages. If Tomcat was running in a console on a Windows operating system, and the console supported ANSI escape sequences, it was possible for an attacker to use a...

CVE-2026-5463

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

CVE-2026-35467

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials...

pymetasploit3 vulnerable to command injection in console.run_module_with_output()

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

EUVD-2026-18601

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

GHSA-QPC3-8VQG-8G6W pymetasploit3 vulnerable to command injection in console.run_module_with_output()

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

Arbitrary Command Injection

Overview pymetasploit3 is an A full-fledged msfrpc library for Metasploit framework. Affected versions of this package are vulnerable to Arbitrary Command Injection via the console.runmodulewithoutput function. An attacker can execute arbitrary commands and manipulate sessions by injecting newlin...

CVE-2026-5463

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

CVE-2026-5463

The vulnerability CVE-2026-5463 affects the pymetasploit3 project (through version 1.0.6) where console.run_module_with_output() accepts newline characters in module options (e.g., RHOSTS). This can break the intended command structure and cause the Metasploit console to execute additional uninte...

CVE-2026-5463 pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

CVE-2026-5463 pymetasploit3 - Command Injection via Newline Injection in console.run_module_with_output()

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

CVE-2026-5463

Command injection vulnerability in console.runmodulewithoutput in pymetasploit3 through version 1.0.6 allows attackers to inject newline characters into module options such as RHOSTS. This breaks the intended command structure and causes the Metasploit console to execute additional unintended...

The vulnerability of the pch_uart_exit_port() function in the drivers/tty/serial/pch_uart.c file of the console TTY driver in the Linux kernel’s serial port module allows a attacker to cause a service failure.

The vulnerability of the pchuartexitport function in the drivers/tty/serial/pchuart.c file of the TTY driver for the console TTY serial port in the Linux operating system is related to improper memory release memory leak. Exploiting this vulnerability could allow an attacker to cause a service...

CVE-2026-35467

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials...

CVE-2026-35467

The cveClient open-source browser-based CVE record management client, developed by the CERT Coordination Center (CERT/CC), contains a security vulnerability where API keys stored in the temporary browser client are not marked as protected. This oversight allows for the extraction of encryption cr...

CVE-2026-35467 Private Key stored as extractable in browser IndexeDB

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials...