CVE-2026-54205

Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality //ServerClientcelink.htm accepts a “pathname” parameter, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection...

CVE-2026-54207

Tobit Laboratories AG TeamDavid's Webbox 's move archive functionality “!ArcEntryMove” accepts an arbitrary path, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

EUVD-2026-54437

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-49008

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

CVE-2026-49006

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission...

CVE-2026-49007

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

CVE-2026-49008 Integrity‑check credential leakage vulnerability in an application function of ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

EUVD-2026-54410

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

CVE-2026-49008

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to the integrity verification of a specific application function on the device...

CVE-2026-49007

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

EUVD-2026-54408

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

CVE-2026-49007

CVE-2026-49007 affects the ZTE F689 device. The issue arises from unencrypted information in the device firmware, enabling an attacker to obtain the initial login credentials for the web interface. Root cause: firmware exposes credentials in plaintext or unprotected form. Impact: credential discl...

CVE-2026-49007 Information leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface...

CVE-2026-49006

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission...

EUVD-2026-54396

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission...

CVE-2026-49006 TLS credential leakage vulnerability in ZTE F689 product

By accessing unencrypted information in the device firmware, an attacker can obtain credentials related to TLS transmission...

CVE-2026-49006

CVE-2026-49006 affects ZTE device firmware. The issue arises from accessing unencrypted information in the firmware, allowing an attacker with adjacent access (AV:A) and high access complexity (AC:H) to obtain credentials related to TLS transmission, with no privileges required and no user intera...

EUVD-2026-54172

Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware defined in packages/server/src/utils/constants.ts. Attackers...

EUVD-2026-54238

Dinky's SysConfigController.getAll handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can rea...

EUVD-2026-54216

An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...