CVE-2026-93332: Missing Authorization

Improper access control in the partial connection API in Devolutions Server 2026.3.5.0 and earlier allows an authenticated low-privileged user to read, create, modify, and delete System Vault entries via a crafted API request...

Epson iProjection Android Application version 3.2.6 Hard-coded Credentials

Epson iProjection Android application version 3.2.6 contains hard-coded credentials that can authenticate to the Web Control interface of affected Epson projectors...

HARDE: Optimizing Agent Harnesses for Runtime Risk Detection and Execution Control

Large language model LLM agents are vulnerable to safety risks such as injected malicious instructions or misleading information, motivating runtime defenses that prevent unsafe action in execution across diverse risks while preserving benign-task utility. Existing system-level defenses either...

CVE-2026-48907

CVE-2026-48907 – Joomla JCE 未认证远程代码执行 RCE 严重性: 严重 CVSS 9.8 / CVSS v4 10.0 CVE: CVE-2026-48907 CWE: CWE-284 – 不适当的访问控制 受影响软件: Joomla 内容编辑器 JCE 扩展 for Joomla 状态: 已公开披露并在野外积极利用。 CVE-2026-48907 是一个影响 Joomla 内容编辑器 JCE 扩展的 严重未认证远程代码执行 RCE 漏洞。 该漏洞源于 JCE 配置文件管理功能中的不适当的访问控制 。攻击者可以在无需认证...

CVE-2026-102335

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

ANT-2026-573F8CSS · cesnet/libyang · Memory Corruption / Stack Buffer Overflow

oob-write high GHSA-44h9-v855-6rj3 Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-573F8CSS: Stack buffer overflow storing LYB...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102334

Nginx Proxy Manager versions through 2.16.0 are vulnerable to brute-force attacks due to a lack of rate-limiting on authentication endpoints. Unauthenticated attackers can make unlimited password guesses via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2fa . Successful ...

CVE-2026-102335

Nginx Proxy Manager versions up to and including 2.16.0 is vulnerable to an improper authorization flaw in the advanced_config field. This flaw allows non-administrator users with manage permissions to inject arbitrary nginx directives . By exploiting this, an attacker can inject malicious config...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102297

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

DEBIAN-CVE-2026-102297

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

CVE-2026-102297

ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Events view permission can call the frames API to list frame records from monitors they are denied access to, disclosing event and frame metadata across monitor...

CVE-2026-102297

ZoneMinder versions before 1.38.4 are vulnerable to an authorization bypass in the FramesController index endpoint . Authenticated users possessing Events view permission can call the frames API to list records from monitors they are not authorized to access. This flaw allows for the disclosure o...

CVE-2026-98017

A flaw was found in the Linux kernel's network traffic control subsystem. This flaw allows a local user with network administration privileges to cause a denial of service DoS or potentially escalate privileges. A use-after-free condition occurs when the kernel prematurely deallocates network...

legacyshield-CVE-2017-0144

LegacyShield — EternalBlue Module A Windows desktop security application that provides a defensive compensating control for systems still exposed to CVE-2017-0144 MS17-010 / EternalBlue — most commonly legacy or unsupported Windows installations that can no longer receive official Microsoft...

ANT-2026-27KVBTTP · wireshark/wireshark · Use-After-Return / Memory Corruption

use-after-free low CVE-2026-76891 Severity Claude high · Security research firm high · Maintainer low Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-27KVBTTP: sharkd tap request leaves danglin...

CVE-2026-101144

A vulnerability exists in Eleveo Call Recording Software 9.7.0 within the Query Builder component. Specifically, an unknown part of the /callrec/searchAction.do file is susceptible to manipulation, resulting in improper access controls . This flaw allows for remote exploitation , and the exploit ...

CVE-2026-101144 Eleveo Call Recording Software Query Builder searchAction.do access control

A vulnerability was determined in Eleveo Call Recording Software 9.7.0. This affects an unknown part of the file /callrec/searchAction.do of the component Query Builder. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly...