CVE-2026-19828

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19825

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=saveservice. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotel...

CVE-2026-19826

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

CVE-2026-19823

A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the...

CVE-2026-19824

A weakness has been identified in Tenda W20E 15.11.0.610681546841CNTDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. Th...

CVE-2026-19827 alldatacenter alldata logDetailCat Endpoint JobLogController.java FileInputStream path traversal

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDetailCat Endpoint. This manipulation of the argument executorAddress causes path traversal. It is possible to initiate the...

CVE-2026-19826

CVE-2026-19826 affects alldatacenter alldata up to version 0.6.8, specifically the Hessian2Input.readObject function in HessianSerializer.java within the xxl-rpc Listener. The issue is a deserialization flaw described as enabling remote exploitation, with an exploit already public. The CVE notes ...

CVE-2026-19826

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

EUVD-2026-58657

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

CVE-2026-19825

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=saveservice. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotel...

CVE-2026-19825 SourceCodester Simple Client Management System Master.php save_service sql injection

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=saveservice. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotel...

CVE-2026-19825

SourceCodester Simple Client Management System 1.0 is affected by a SQL injection in /classes/Master.php?f=save_service when the ID argument is manipulated. The vulnerability enables remote exploitation and has publicly disclosed exploit information. The issue is consistently described across CVE...

EUVD-2026-58655

A weakness has been identified in Tenda W20E 15.11.0.610681546841CNTDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. Th...

CVE-2026-19824

A weakness has been identified in Tenda W20E 15.11.0.610681546841CNTDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. Th...

CVE-2026-19824

CVE-2026-19824 affects Tenda W20E firmware version 15.11.0.6 CN_TDC. The vulnerability resides in the function ipMacBindListStore within /goform/addIpMacBind, where manipulation of the argument IPMacBindRule can trigger a stack-based buffer overflow. The issue is described as exploitable remotely...

CVE-2026-19824 Tenda W20E addIpMacBind ipMacBindListStore stack-based overflow

A weakness has been identified in Tenda W20E 15.11.0.610681546841CNTDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. Th...

CVE-2026-19822

A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. T...

CVE-2026-19823

A security flaw has been discovered in Tenda W20E 15.11.0.610681546841CNTDC. Impacted is the function formQOSRuleDel of the file /goform/delQos of the component QoS Rule Deletion. Performing a manipulation of the argument qosIndex results in stack-based buffer overflow. Remote exploitation of the...

CVE-2026-72835 filebrowser before v2.63.21 Access Rule Bypass via Path Canonicalization

filebrowser versions before v2.63.21 fail to canonicalize paths before evaluating access rules, allowing authenticated users to bypass administrator-defined deny rules using case-variant or backslash-separated paths. Attackers can request files with alternate path representations that match no ru...

CVE-2026-72834 filebrowser before 2.63.19 Permission Bypass via checksum

filebrowser before 2.63.19 contains a permission bypass in the /api/resources endpoint. The checksum ?checksum= branch of resourceGetHandler reads the entire file to compute a digest and returns it without performing a Perm.Download check unlike the sibling raw, preview, and subtitle paths. As a...