CVE-2026-80156

Lantronix autonomous out-of-band devices (SLC8000, EMG8500, EMG7500, SLB882, SLCx-03, SLCx-02) are affected by a path traversal vulnerability in the web management portal upload endpoint. The root cause is that the filename validation strips backslash characters but fails to subsequently check fo...

CVE-2026-80155 Lantronix Autonomous Out-of-Band Devices Unauthenticated Authentication Bypass via snprintf Path Truncation

Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated...

EUVD-2026-84521

Lantronix SLC8000 before firmware v9.7.0.5, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain an authentication bypass vulnerability in the web management portal upload endpoint that allows unauthenticated attackers to read sensitive configurati...

CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

CVE-2026-80154 Lantronix Autonomous Out-of-Band Devices Predictable Session Token with Validation Bypass

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

UBUNTU-CVE-2026-79313

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

CVE-2026-79313

webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. As a result, an expired session whose record has not yet been cleaned up can...

cve-2018-15473

CVE-2018-15473 これはCvedの一部です： 脆弱なDockerコンテナを管理するツール Cved: https://github.com/git-rep-src/cved 画像ソース: https://github.com/cved-sources/cve-2018-15473 画像作成者: https://github.com/cved-sources/cve-2018-15473...

CVE-2025-58434-PoC

CVE-2025-58434 の PoC POST /api/v1/account/forgot-password をトリガーする Python の PoC スクリプトです。 ⚠️ 教育目的および許可されたセキュリティ研究のみを対象としています。 自分が所有していない、または書面によるテスト許可がないシステムに対してこのツールを実行することは違法です。 クレジット zaddy6 Isaac David arthurgervais Arthur Gervais 詳細 CVE-2025-58434 の PoC 参照:...

CVE-2026-95675

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

Check-Point-Trusted-Access-Review

Check Point Trusted Access Review ベンダーのパッチは可能な限り迅速に適用してください。 信頼できるCheck Point Management APIコマンドを使用してCheck Point Trusted Access Reviewを実施するためのローカルWebアプリケーションです。ほとんどのチェックは確認のみです。利用可能な修復アクションには、明示的なオペレーターの承認が必要です。 このスキャナーは、CVE-2026-16232...

Zero-Day-Legacy

🎓 卒業プロジェクト — Ajloun National University ANU IT学部 · サイバーセキュリティ＆クラウドコンピューティング · 2026年度 🏆 大学最高評価：97% 📖 概要 Zero-Day Legacy は、Ajloun National University の卒業プロジェクトとして構築された、現実的で意図的に脆弱性を持たせた Boot-to-Root CTF（Capture The Flag） ラボマシンです。複数の脆弱性クラスにわたる完全な実世界の攻撃チェーンを包含する、Royal Health Hospital という病院管理システ...

EUVD-2026-84394

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

CVE-2026-95675

D-Link DAP-1360 firmware 6.14 and earlier is affected by an unauthenticated remote code execution vulnerability in the device's web management interface . Remote attackers can send crafted requests without valid credentials to execute arbitrary commands as root , enabling full device compromise, ...

CVE-2026-95675 D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

cve-2018-19207

CVE-2018-19207 これはCvedの一部です: 脆弱なDockerコンテナを管理するツール Cved: https://github.com/git-rep-src/cved イメージソース: https://github.com/cved-sources/cve-2018-19207 イメージ作成者: https://github.com/cved-sources/cve-2018-19207...

CVE-2026-93616

A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Management Server...

CVE-2020-25270

CVE-2020-25270 PHPGurukul hostel-management-system 2.1 は、Guardian Name、Guardian Relation、Guardian Contact no、Address、City において XSS を許容します。 ベンダー - PHPGurukul 製品 - https://phpgurukul.com/hostel-management-system V2.1 脆弱性タイプ - クロスサイトスクリプティング XSS 追加情報 - XSS は両側でトリガーされます。ユーザーは管理者の Cookie...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...

artemis-server: Apache Artemis — session hijack via missing authentication

in Apache Artemis, the REATTACHSESSION handler performs zero authentication — it looks up the session by name only and calls transferConnection unconditionally, migrating the authenticated session to the attacker's connection. The hijacked cluster-bridge session inherits full broker-management...