EUVD-2022-56078

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition...

CVE-2022-29966 Emerson Ovation Missing Authentication for Critical Functionality

Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller configuration or cause a denial-of-service condition...

CVE-2022-29966

The Emerson Ovation system, specifically versions 3.8.0 Feature Pack 1 and prior , is vulnerable to Missing Authentication for Critical Function (CWE-306) . Several protocols lack authentication, which could allow a remote attacker to change controller configurations or trigger a denial-of-servic...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated by NULLBDEVICEATTR refuse to modify the configuration of a live device by checking for NULLBDEVFLCONFIGURED; however, this flag...

WAGO-CVE-2023-1698

WAGO-CVE-2023-1698 WAGO System Remote Code Execution Vulnerability CVE-2023-1698 Attention I have developed a tool for local testing and POC development, which is for technical learning reference only. Please do not use it for illegal purposes. Any direct or indirect consequences and losses cause...

CVE-2023-28810

CVE-2023-28810 Exploit code for CVE-2023-28810. udp-config-changer.py Change the running configuration of a target hikvision intercom without needing any authentication. udp-password-brute.py Attempt to recover the admin password for the device via brute force guessing wordlist not supplied...

EUVD-2026-113764

Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. An unauthenticated attacker with adjacent network access can reconstruct the resulting password, or exhaust the keyspace, and log in to read and change...

CVE-2026-22110: Delta Electronics Delta UFC500: The web server does not check authentication on POST or PUT

The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the configid, they can also set the service password and then change any setting...

CVE-2026-33923

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsign...

CVE-2026-33923 Update bundle signature bypass in Guardian/CMC before 26.4.0

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsign...

EUVD-2026-112723

A signature verification vulnerability was discovered in the update installation functionality due to inconsistent validation of the update bundle contents. An attacker with administrative privileges can remotely supply a crafted update bundle that passes signature verification but runs an unsign...

CVE-2026-112239

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its...

EUVD-2026-104864

The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can therefore change any property of any page, including its...

CVE-2026-105039

EnergizeLab station-middleware NestJS Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents...

CVE-2026-105038

The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime...

CVE-2026-71490

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsense\Core\ACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write...

PT-2026-115001

OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11, OPNsenseCoreACL::hasPrivilege appends a directly assigned comma-separated value as one string and then uses an exact comparison when checking user-config-readonly. A user directly assigned both a component write privileg...

CVE-2026-109439

The Lantronix XPress-DR and XPress-DR-I (CoBos-family) devices with firmware through 8.1.0.0 are vulnerable to an unauthenticated configuration write via the UDP configuration protocol on port 30718 . A remote attacker can send a type 0xF8 query to read live configuration data or a type 0xFD fram...

CVE-2026-15577

A flaw was found in Grafana. An improper authorization vulnerability allows an authenticated user or service account with read-only access to modify Git Sync connection configurations through the status subresource. Consequently, an attacker can make unauthorized configuration changes despite...

CVE-2026-104678 CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update

The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...