CVE-2026-110115

Risesoft Digital-Infrastructure versions 9.6.5 through 9.6.11 are vulnerable to a path traversal vulnerability within the fileManager component, specifically in the Y9FileController.retrieveFileStream handler. This flaw allows unauthenticated attackers to read arbitrary files by injecting parent-...

CVE-2026-110115 Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters...

CVE-2026-110115 Digital-Infrastructure 9.6.5 through 9.6.11 Path Traversal via fileManager retrieveFileStream

Risesoft Digital-Infrastructure 9.6.5 through 9.6.11 contains a path traversal vulnerability in the fileManager Y9FileController.retrieveFileStream handler that allows unauthenticated attackers to read arbitrary files by supplying parent-directory segments in the fullPath and fileName parameters...

CVE-2026-55183

RClone Manager is a cross-platform GUI application designed to help users manage Rclone remotes efficiently. Prior to 0.2.7, RClone Manager starts the local rclone rcd service on 127.0.0.1:51900 with --rc-no-auth, --rc-allow-origin , and --rc-serve. A malicious web page opened by a user while the...

CVE-2026-106042

Ivanti Xtraction versions before 2026.4 are affected by an External Control of File Name or Path vulnerability (CWE-73). This flaw allows a remote authenticated attacker to redirect application-generated requests to an attacker-controlled endpoint. Successful exploitation enables the attacker to ...

CVE-2026-9218

Certain NETGEAR routers are vulnerable to an insufficient input validation vulnerability within the time server (NTP) setting . An attacker who is connected to the router's local network and possesses administrator credentials can exploit this flaw to execute unauthorized commands on the device. ...

Windows Update Orchestrator Service Security Feature Bypass Vulnerability

Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally...

gha-lab-8e9316151c

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

CVE-2026-109245

A flaw was found in FreeRDP. This vulnerability leads to information disclosure because the internal HTTP client fails to verify Transport Layer Security TLS server certificates or hostnames. An on-path network attacker positioned between the client and identity provider can exploit this flaw by...

Zena-CVE-2021-45026

Zena - Stored XSS to RCE Exploit POC Exploit POC for Rocket Software's Zena application v. 4.2.1 - Stored XSS to RCE CVE-2021-45025 CVE-2021-45026 https://phoenix-sec.io/2022/06/17/Zena-CookieMonsteRCE.html POC Process: Logs into Zena's webconfig page using default credentials Drops Stored XSS...

CVE-2025-1242

CVE-2025-1242: Exposure of Administrative IoT Hub Credentials Advisory Field| Value ---|--- CVE| CVE-2025-1242 ICSA| ICSA-26-055-03 CVSS 3.1| 9.1 Critical Vector| CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N CWE| CWE-798 Use of Hard-coded Credentials Researcher| Michael Groberman — Gr0m Published...

CVE-2026-89199

The RUGGEDCOM CROSSBOW (all versions

CVE-2026-89199

A vulnerability has been identified in RUGGEDCOM CROSSBOW All versions V6.0. Affected devices do not properly restrict access to sensitive configuration items via specific database queries. This could allow an authenticated attacker to retrieve administrative credentials for various internal...

CVE-2026-109143

A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The...

CVE-2026-109143 calcom cal.com/cal.diy Credentials delete credentials.delete privileges management

A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the file /api/trpc/credentials/delete of the component Credentials Handler. This manipulation of the argument teamId causes improper privilege management. The...

CVE-2026-109143

The software calcom , cal.com , and cal.diy (versions up to 6.2.0 ) contains a vulnerability in the Credentials Handler component. Specifically, the credentials.delete function within the /api/trpc/credentials/delete file is susceptible to improper privilege management due to the manipulation of ...

CVE-2025-12539

CVE-2025-12539 TNC Toolbox: Web Performance = 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover 🚨 TNC Toolbox: Web Performance = 1.4.2 - Unauthenticated Sensitive Information Exposure to Privilege Escalation/cPanel Account Takeover 🛡️ Descriptio...

CVE-2026-67165 HCL Connections is vulnerable to cross-site scripting (XSS)

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

CVE-2026-103417

Firefox for iOS is vulnerable to a credential autofill issue where saved credentials could be autofilled into a new page following a cross-origin navigation. The root cause is that the autofill mechanism was not bound to the originating page and failed to reject the request when the origin change...

CVE-2022-24716-2

CVE-2022-24716 Icinga Web 2 is an open source monitoring web interface, framework and command line interface. Unauthenticated users can leak the contents of user-accessible local system files from the web server, including icingaweb2 configuration files with database credentials. Installation Usa...