CVE-2026-71290

Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...

CVE-2026-73032 PapersGPT for Zotero 0.6.1 RCE via Unsanitized LLM Response eval()

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability that allows attackers to execute arbitrary JavaScript by returning malicious code from an LLM endpoint that is passed unsanitized to window.eval in views.ts. Attackers can exploit this through prompt injection in PDFs, MITM...

CVE-2026-73032

PapersGPT for Zotero 0.6.1 contains a remote code execution vulnerability: an unsanitized LLM response passed to window.eval() in views.ts allows arbitrary JavaScript execution in Zotero's chrome-privileged context. Attackers can exploit prompt injection in PDFs, MITM interception of API requests...

CVE-2026-11814 Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic attacker-in-the-middle to compromise the confidentiality and integrity of the affected device. This issue is limited to certain...

CVE-2026-11814 Command injection vulnerability in certain NETGEAR Nighthawk and Orbi routers

A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic attacker-in-the-middle to compromise the confidentiality and integrity of the affected device. This issue is limited to certain...

PT-2026-70232

Name of the Vulnerable Software and Affected Versions NETGEAR Nighthawk affected versions not specified Description A command injection flaw allows a network-adjacent attacker who can intercept and modify local network traffic attacker-in-the-middle to compromise the confidentiality and integrity...

CVE-2026-13717

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

EUVD-2026-55807

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

CVE-2026-13717 Rhoai maas: llm-d: maas/llm-d inference gateway: default allowedroutes.namespaces.from: all allows namespace users to hijack shared model-serving traffic (tokens, prompts, outputs)

A flaw was found in the Red Hat OpenShift AI RHOAI MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-21079

Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...

CVE-2026-66410

CVE-2026-66410 affects the Android and iOS ECOVACS PRO App, with improper server certificate validation in the smartphone app. The vulnerability can allow a man-in-the-middle to retrieve and/or alter communications between the app and servers. Connected documents confirm the issue and reference r...

CVE-2026-66410

Android and iOS apps ECOVACS PRO App improperly validate server certificates. Communication may be retrieved and/or altered...

CVE-2026-66407

DEEBOT PRO M1 and DEEBOT PRO K1VAC improperly implement authentication in WebSocket communication. The WebSocket private key may be retrieved through analyzing the traffic data via a man-in-the-middle attack, and communication contents may be altered...

CVE-2026-21079

CVE-2026-21079 concerns Samsung Smart Switch prior to version 3.7.72.6, where missing encryption of sensitive data allows adjacent attackers to intercept transmitted data. The affected component is the Smart Switch data transmission flow; the root cause is lack of encryption for sensitive data in...

CVE-2026-21079

Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...

CVE-2026-21079

Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...

EUVD-2026-55104

Missing encryption of sensitive data in Smart Switch prior to version 3.7.72.6 allows adjacent attackers to intercept transmitted data...

PT-2026-69950

Name of the Vulnerable Software and Affected Versions Red Hat OpenShift AI RHOAI MaaS Gateway affected versions not specified Description Improper configuration of the MaaS Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS...

PT-2026-69873

Name of the Vulnerable Software and Affected Versions multicluster-global-hub affected versions not specified Description A flaw occurs during a ManagedClusterMigration where the system incorrectly grants all managed hubs read access to a shared communication topic. This allows a compromised...