CVE-2026-80928

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...

CVE-2026-89762 apparmor: fix cred UAF caused by begin_current_label_crit_section()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89762 apparmor: fix cred UAF caused by begin_current_label_crit_section()

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix cred UAF caused by begincurrentlabelcritsection AppArmor's begincurrentlabelcritsection is a scary function called from lots of LSM hooks in particular VFS/socket-related ones that checks if the label referenced by...

CVE-2026-89539 SUNRPC: reject duplicate CREDS_VALUE options

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: reject duplicate CREDSVALUE options gssxdecoptionarray walks the wire-supplied option array and, for every entry whose name matches CREDSVALUE, calls gssxdeclinuxcreds on the same struct svccred. That helper unconditional...

CVE-2026-80928

In the Linux kernel, the following vulnerability has been resolved: smack: fix cred UAF in smackfilesendsigiotask When inspecting the credentials of another task, objective credentials -realcred, accessed with taskcred must always be used. Accessing -cred on a non-current task is forbidden unless...

CVE-2026-79396

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...

Vulnerabilty-Assessment-Detection-Lab

Vulnerability Assessment & Detection Lab End-to-end vulnerabi...

CVE-2026-18061 Improper Restriction of XML External Entity References in AWS Advanced JDBC Wrapper RemoteQueryCachePlugin

Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might allow an actor with write access to the shared cache infrastructure to disclose sensitive files from application hosts that read cached query results,...

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-81861

CWE-522: Insufficiently Protected Credentials vulnerability that could result in exposure of authentication information and unauthorized access to RTU functionality...

CVE-2026-81861

CVE-2026-81861 affects Schneider Electric SCADAPack and stems from CWE-522 (Insufficiently Protected Credentials) in the Secure Lock component. The flaw could expose authentication information and permit unauthorized access to RTU functionality . The CVSS 4.0 base score is 5.9 (MEDIUM) , with a n...

CVE-2026-85083 CareCam Pro IP Cameras Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

CVE-2026-85083

CVE-2026-85083 affects the ANJIA AJL33PC0801 IP camera (CareCam Pro), which ships with a hard-coded credential used for bootloader authentication . The affected firmware is linuxlinux202008261138 svn13796 with U-Boot 2010.06 (compiled Aug 26, 2020). An attacker with physical access can exploit th...

CVE-2026-85083 CareCam Pro IP Cameras Use of Hard-coded Credentials

The ANJIA AJL33PC0801 IP camera uses a hard-coded credential for bootloader authentication. An attacker with physical access to the device may leverage this weakness to gain privileged bootloader access, allowing unauthorized modification of firmware and system configuration and potentially...

CVE-2026-38058 ST Engineering iDirect iQ-Series Terminals Exposure of Sensitive System Information to an Unauthorized Control Sphere

The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which contains MD5-crypt password hashes for the root SSH and web administration accounts. Any user with valid web credentials can extract these hashes and crack them...

CVE-2025-15679

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515...

Vulnerabilities hidden in Arista EOS

Arista has identified vulnerabilities in the Arista EOS platform. The vulnerability with identifier CVE-2026-73456 occurs during the processing of requests sent via gNPSI. Under this vulnerable configuration, an unauthenticated client can send malicious requests, potentially leading to code...

EUVD-2026-75798

IBM ContextForge MCP Gateway 1.0.0 through 1.0.7 could allow a remote attacker to gain administrative access due to the use of default credentials...

CVE-2026-79396: Use of Hard-coded Credentials

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...