666 matches found
CVE-2026-2491
Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Socomec DIRIS A-40 power monitoring devices. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2026-2491: Missing Authentication for Critical Function
Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Socomec DIRIS A-40 power monitoring devices. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2026-2491 Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability
Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Socomec DIRIS A-40 power monitoring devices. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2026-2491
CVE-2026-2491 : Socomec DIRIS A-40 HTTP API Authentication Bypass. The web API (default port 80) lacks authentication, enabling network-adjacent attackers to bypass auth and access functionality on affected DIRIS A-40 power monitoring devices. Root cause is missing authentication prior to exposin...
PT-2026-23457
Name of the Vulnerable Software and Affected Versions RustDesk Client versions through 1.4.5 Description A flaw exists in RustDesk Client on Windows, MacOS, Linux, iOS, Android, and WebClient that allows manipulation of Application API Messages through a Man-in-the-Middle attack. The issue is...
Exploit for SQL Injection in Fortinet Fortiweb
CVE-2025-25257 Detection Engineering Repository !CVEhttps:...
PT-2026-20432
Name of the Vulnerable Software and Affected Versions: Grandstream GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630 versions prior to 1.0.7.81. Description: A critical unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. This...
GrandStream GXP1600 Unauthenticated Remote Code Execution
An unauthenticated stack-based buffer overflow vulnerability exists in the HTTP API endpoint /cgi-bin/api.values.get. A remote attacker can leverage this vulnerability to achieve unauthenticated remote code execution RCE with root privileges on a target device. The vulnerability affects all six...
CVE-2026-2629 jishi node-sonos-http-api TTS Provider mac-os.js Promise os command injection
A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tts-providers/mac-os.js of the component TTS Provider. This manipulation of the argument phrase causes os command injection. It is possible ...
CVE-2026-2629: Improper Neutralization of Special Elements used in an OS Command
A weakness has been identified in jishi node-sonos-http-api up to 3776f0ee2261c924c7b7204de121a38100a08ca7. Affected is the function Promise of the file lib/tts-providers/mac-os.js of the component TTS Provider. This manipulation of the argument phrase causes os command injection. It is possible ...
CVE-2025-41117
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo ...
CVE-2025-41117: Improper Neutralization of Input During Web Page Generation
Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious JavaScript to be entered into the stack trace field. Only datasources with the Jaeger HTTP API appear to be affected; Jaeger gRPC and Tempo ...
REC in MCPJam inspector due to HTTP Endpoint exposes
Summary MCPJam inspector is the local-first development platform for MCP servers. The Latest version Versions 1.4.2 and earlier are vulnerable to remote code execution RCE vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leadi...
http-api-problem (>=0.23.0, <=0.50.2) potentially affected by CVE-2026-22256 via salvo (>=0.9.7, <=0.11.6)
salvo CARGO version =0.9.7, =0.23.0, =0.50.2 Source cves: CVE-2026-22256 Source advisory: OSV:GHSA-RJF8-2WCW-F6MP...
http-api-problem (>=0.23.0, <=0.50.2) potentially affected by CVE-2026-22257 via salvo (>=0.9.7, <=0.11.6)
salvo CARGO version =0.9.7, =0.23.0, =0.50.2 Source cves: CVE-2026-22257 Source advisory: OSV:GHSA-54M3-5FXR-2F3J...
PT-2025-50896
Name of the Vulnerable Software and Affected Versions AzuraCast versions 0.23.1 Description AzuraCast is a self-hosted, all-in-one web radio management suite. Version 0.23.1 mistakenly includes an API endpoint intended for internal use by the SFTP software sftpgo, exposing it to the public-facing...
CVE-2025-67737: Missing Authorization
AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the SFTP software sftpgo, exposing it to the public-facing HTTP API for AzuraCast installations. A user with specific internal knowledge of a...
EUVD-2021-13278
Malware in sbrugna...