CVE-2026-65893

CVE-2026-65893 affects the CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. The flaw enables an attacker with physical access to place arbitrary code on removable media and trigger execution through the debug mechanism, allowing arbitrary code execution with elev...

EUVD-2026-49116

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism. Successful...

CVE-2026-65893 Arbitrary Code Execution Vulnerability in CP PLUS EZ-P21 IP Camera

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism. Successful...

CVE-2026-65893

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism. Successful...

PT-2026-65305

Name of the Vulnerable Software and Affected Versions Prospero Flow CRM affected versions not specified Description An Insecure Direct Object Reference IDOR exists in the DeleteNotificationController::delete method at the GET /notification/delete/id endpoint. This flaw allows any authenticated us...

PT-2026-64934

Subscriber Insecure Direct Object References IDOR in Paid Member Subscriptions = 3.0.7 versions...

PT-2026-64861

This vulnerability exists in CP PLUS EZ-P21 IP Camera due to an insecure debug feature enabled in the firmware. An attacker with physical access could exploit this vulnerability by placing arbitrary code on removable media and triggering their execution through the debug mechanism. Successful...

ROS-20260727-73-0024

A vulnerability in httpd related to insecure privilege management. Exploiting this vulnerability could allow an attacker to elevate their privileges...

SUSE CVE-2026-13204

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof. This issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through...

SUSE CVE-2026-50243

In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer...

Exploit for SQL Injection in Wordpress

CVE-2026-60137-With-Skip-...

Exploit for Code Injection in Kidocode Crawl4Ai

CVE-2026-26216 — Crawl4AI unauthenticated RCE via hooks GHS...

Linux Distros Unpatched Vulnerability : CVE-2026-50243

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In NLnet Labs Unbound 1.6.2 up to and including 1.25.1, when Unbound is configured with the 'respip' module in front of the validator together with a...

Open WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)

Open WebUI upload metadata can add files to knowledge bases without write permission Summary Open WebUI's file upload background processing trusts the client-supplied metadata.knowledgeid value and inserts a knowledgefile association before validating that the uploading user has write access to t...

Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...

CVE-2026-65708

CVE-2026-65708 affects sysPass version 3.2.11. An insecure direct object reference in the AccountFileController lets any authenticated attacker access account file attachments they lack ACL permissions for by supplying arbitrary numeric file IDs in actions such as download, view, delete, upload, ...

CVE-2026-65708

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

CVE-2026-65708 sysPass 3.2.11 Insecure Direct Object Reference via AccountFileController

sysPass through version 3.2.11 contains an insecure direct object reference vulnerability that allows any authenticated attacker to access account file attachments belonging to accounts they do not have ACL permissions for by exploiting missing authorization checks in AccountFileController...

SUSE-SU-2026:3241-1 Security update for gzip

This update for gzip fixes the following issue: - CVE-2026-41991: insecure temporary file handling in the gzexe utility when the mktemp utility is not available in the user's PATH bsc1269622...

OESA-2026-3146 perl security update

Perl 5 is a highly capable, feature-rich programming language with over 30 years of development. Perl 5 runs on over 100 platforms from portables to mainframes and is suitable for both rapid prototyping and large scale development projects. Security Fixes: Perl versions through 5.43.9 produce...