PYSEC-2025-70

A Server-Side Request Forgery SSRF vulnerability exists in the RequestsToolkit component of the langchain-community package specifically, langchaincommunity.agenttoolkits.openapi.toolkit.RequestsToolkit in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does n...

CVE-2025-2828

A Server-Side Request Forgery SSRF vulnerability exists in the RequestsToolkit component of the langchain-community package specifically, langchaincommunity.agenttoolkits.openapi.toolkit.RequestsToolkit in langchain-ai/langchain version 0.0.27. This vulnerability occurs because the toolkit does n...

CVE-2025-6524 70mai 1S Video Services improper authentication

A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Services. The manipulation leads to improper authentication. Access to the local network is required for this attack to succeed. The complexity of an attack is...

CVE-2025-6524 70mai 1S Video Services improper authentication

A vulnerability classified as problematic has been found in 70mai 1S up to 20250611. This affects an unknown part of the component Video Services. The manipulation leads to improper authentication. Access to the local network is required for this attack to succeed. The complexity of an attack is...

CVE-2025-6524

The CVE-2025-6524 entry concerns 70mai 1S devices (up to 20250611) with a vulnerability in the Video Services component. The issue is described as an improper authentication flaw that requires access to the local network, with attack complexity rated as HIGH. Public disclosure of the exploit is n...

PT-2025-26652

Name of the Vulnerable Software and Affected Versions: 70mai M300 up to 20250611 Description: A critical issue was found in the Telnet Service component, allowing the use of default credentials. The attack must be initiated within the local network. The exploit has been disclosed to the public an...

CVE-2025-6139

A vulnerability, which was classified as problematic, has been found in TOTOLINK T10 4.1.8cu.5207. Affected by this issue is some unknown functionality of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can only be initiated within the local network...

CVE-2024-13087

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version:...

CVE-2024-13088

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later...

CVE-2024-13088

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later...

CVE-2024-13087

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version:...

CVE-2024-13088 QHora

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later...

CVE-2024-13088 QHora

An improper authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the vulnerability to compromise the security of the system. We have already fixed the vulnerability in the following version: QuRouter 2.5.0.140 and later...

CVE-2024-13087 QHora

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version:...

CVE-2024-13087 QHora

A command injection vulnerability has been reported to affect QHora. If an attacker gains local network access who have also gained an administrator account, they can then exploit the vulnerability to execute arbitrary commands. We have already fixed the vulnerability in the following version:...

CVE-2024-13087

CVE-2024-13087 affects QNAP QHora/Qurouter devices. A command injection flaw exists in the router OS, enabling a user with local network access and an administrator account to cause arbitrary code execution via the miro_webserver_lib_RunExecBash path (poor input validation). Impact is described a...

PT-2025-24289

Name of the Vulnerable Software and Affected Versions QuRouter versions prior to 2.5.0.140 Description An improper authentication issue has been reported, affecting the security of the system if an attacker gains local network access. Recommendations For versions prior to 2.5.0.140, update to...

CVE-2025-5228

A vulnerability was found in D-Link DI-8100 up to 20250523. It has been classified as critical. Affected is the function httpdgetparm of the file /login.cgi of the component jhttpd. The manipulation of the argument notify leads to stack-based buffer overflow. The attack can only be initiated with...

CVE-2025-5228

The CVE-2025-5228 affects D-Link DI-8100 up to version 20250523. The vulnerability is in the jhttpd component’s httpd_get_parm function, where manipulating the notify argument in /login.cgi leads to a stack-based buffer overflow. This can be exploited by an attacker within the local network, and ...

CVE-2024-48865

An improper certificate validation vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow attackers with local network access to compromise the security of the system. We have already fixed the vulnerability in the following...