CVE-2026-88285

GeoVision GV-LPC2211 V1.13 exposes a network-accessible PTZ control service that requires no authentication, allowing remote clients to retrieve PTZ information and issue PTZ or raw serial commands. The underlying cause is the lack of an authentication mechanism on the service itself. The CVSS v3...

GHSA-2R5Q-H53F-9RP3 @yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

@yeger/turbo-graph: Unauthenticated Network-Exposed Task Execution via /api/run

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

PT-2026-89211

Unauthenticated Network-Exposed Turborepo Task Execution via /api/run Summary @yeger/turbo-graph starts its embedded Next.js server without binding to the loopback interface, causing it to listen on all network interfaces 0.0.0.0:29312 by default. The /api/run HTTP endpoint exposed by this server...

EUVD-2026-63470

dbx is a cross-platform database client for databases. Prior to 0.5.51, dbx-web authmiddleware in crates/dbx-web/src/auth.rs passes every protected request to the handler chain when passwordhash is None. A fresh deployment reaches that state when DBXPASSWORD is unset and no stored password exists...

GO-2026-5317 Tilt: Missing authentication on the network-exposed Tilt HUD server in github.com/tilt-dev/tilt

Tilt: Missing authentication on the network-exposed Tilt HUD server in github.com/tilt-dev/tilt...

CVE-2026-9717

CWE-78 Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts wi...

CVE-2026-9718

Technical details about CVE-2026-9718 are not publicly available in the provided documents; monitor for updates from official advisories.

EUVD-2026-39434

CWE-78 Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts wi...

CVE-2026-9717

CWE-78 Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts wi...

CVE-2026-45727

CloakBrowser is a tool to bypass bot detection tests. Prior to version 0.3.28, the cloakserve CDP multiplexer uses the user-supplied fingerprint query parameter directly as a filesystem path component when creating Chrome profile directories. An unauthenticated attacker who can reach the cloakser...

Missing Authentication for Critical Function

Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the fetchModule method exposed through the WebSocket interface when the server is explicitly exposed to the network and WebSocket is enable...

CVE-2026-34980

OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and prior, in a network-exposed cupsd with a shared target queue, an unauthorized client can send a Print-Job to that shared PostScript queue without authentication. The server...

Exploit for CVE-2025-11953

React Native CLI Command Injection Demo CVE-2025-11953 ⚠...

CVE-2025-54923

CVE-2025-54923 affects Schneider Electric EcoStruxure Power Monitoring Expert (and related modules) with a deserialization of untrusted data vulnerability that can lead to remote code execution. Public sources in the connected set describe an issue in the GetFilteredSinkProvider/unsafe deserializ...

CVE-2025-31125 Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. This vulnerability is fixed in 6.2.4, 6.1.3,...

CVE-2023-41255

The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abusing the lack of authentication of the ‘su’ binary file installed on the device that can be accessed through the ADB Android Debug Bridge protocol exposed on...

QNAP QTS / QuTS hero Path Traversal (QSA-23-42)

The version of QNAP QTS / QuTS hero installed on the remote host is affected by a vulnerability as referenced in the QSA-23-42 advisory. A path traversal vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to read the...

CVE-2023-3656

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by an unauthenticated remote code execution vulnerability. This vulnerability can be triggered by an HTTP endpoint exposed to the network...

CVE-2023-3654 Origin Check Bypass

cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origin bypass via the host header in an HTTP request. This vulnerability can be triggered by an HTTP endpoint exposed to the network...