118 matches found
CVE-2026-72924: Binding to an Unrestricted IP Address
GitHub CLI gh is GitHub's official command line tool. Versions 2.28.0 through 2.97.0 bind the local listener created by gh codespace ports forward to all available network interfaces by default. While port forwarding is active, a service in a Codespace can therefore become reachable through the...
CVE-2026-18279
Sony XAV-9500ES RTSP SETUP Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sony XAV-9500ES devices. Authentication is not required to exploit this vulnerability. The specific flaw exis...
EUVD-2026-58802
PAX Technology Q80 Application Installer Signature Verification Bypass Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability...
CVE-2026-19908
CVE-2026-19908 affects the PAX Technology Q80 XCB Daemon. The flaw arises from a lack of authentication before accessing daemon functionality, allowing network-adjacent attackers to disclose sensitive information and modify configurations. The description also notes potential to execute arbitrary...
EUVD-2026-58800
PAX Technology Q80 AIP File Parsing Link Following Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2026-19908: Missing Authentication for Critical Function
PAX Technology Q80 XCB Daemon Missing Authentication Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information and modify configuration on affected installations of PAX Technology Q80. Authentication is not required to exploit this vulnerability. The...
CVE-2026-11739 Command injection vulnerability in some NETGEAR Nighthawk devices
A command injection vulnerability in certain affected NETGEAR Nighthawk devices allows a network-adjacent attacker with the ability to intercept and modify local network traffic attacker in the middle to compromise the confidentiality and integrity of the affected device...
PT-2026-70233
Name of the Vulnerable Software and Affected Versions NETGEAR affected versions not specified Description A command injection flaw allows a network-adjacent attacker who can intercept and modify local network traffic attacker-in-the-middle to compromise the confidentiality and integrity of the...
CVE-2026-47669: Improper Limitation of a Pathname to a Restricted Directory
DbGate is cross-platform database manager. In versions 7.1.8 and prior, the unzipDirectory function in packages/api/src/shell/unzipDirectory.js line 27 does not validate that extracted file paths stay within the output directory. A malicious ZIP with ../ entries writes files anywhere on the...
CVE-2026-15683: Improper Certificate Validation
Lorex 2K Indoor Wi-Fi Security Camera Device Management Server Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Lorex 2K Indoor Wi-Fi Security Cameras. User interaction is not required to...
CVE-2026-54411: Observable Timing Discrepancy
Linux-PAM through 1.7.2 contains an observable timing discrepancy CWE-208 in the pamuserdb module's plaintext-password comparison path in modules/pamuserdb/pamuserdb.c that allows a local or network-adjacent attacker able to repeatedly drive authentication through a calling service to recover the...
CVE-2026-3559: Reusing a Nonce, Key Pair in Encryption
Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific...
CVE-2026-2491: Missing Authentication for Critical Function
Socomec DIRIS A-40 HTTP API Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Socomec DIRIS A-40 power monitoring devices. Authentication is not required to exploit this vulnerability. The specific flaw...
CVE-2026-3561: Heap-based Buffer Overflow
Philips Hue Bridge hkhap characteristics Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Philips Hue Bridge. Although authentication is required to exploit this vulnerabilit...
CVE-2026-0407: Improper Authentication
An insufficient authentication vulnerability in NETGEAR WiFi range extenders allows a network adjacent attacker with WiFi authentication or a physical Ethernet port connection to bypass the authentication process and access the admin panel...
CVE-2024-41720
Incorrect permission assignment for critical resource issue exists in ZWX-2000CSW2-HN firmware versions prior to Ver.0.3.15, which may allow a network-adjacent authenticated attacker to alter the configuration of the device...
EUVD-2020-7619
Malware in sbrugna...
EUVD-2021-21510
Malware in sbrugna...