EUVD-2026-89405

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-95364

An improper input validation flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/553271219...

CVE-2026-95312

An information leak flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/547832510...

CVE-2026-22101

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

CVE-2026-22094

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

CVE-2026-22094

The firmware for the EVbee DC-80 contains a weak hardcoded root password . This vulnerability allows an attacker to gain root access by authenticating through the SSH daemon , which is exposed to the network. No specific remediation or exploit details are provided in the documents.

EUVD-2026-88973

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

CVE-2026-22094 Weak root password in EVbee DC 80

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

CVE-2026-22094 Weak root password in EVbee DC 80

The firmware for the EVbee DC-80 has a weak hardcoded root password, which allows attackers to login as root using the SSH daemon that is exposed to the network...

CVE-2026-22101

A sensitive information leak exists via an obfuscated service menu accessible with physical access . This vulnerability allows an attacker to view sensitive data, including serial numbers , MAC addresses , and WiFi network passwords . No specific software or hardware versions or remediation steps...

CVE-2026-22101 Sensitive information leak through hidden menu

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

EUVD-2026-88972

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

CVE-2026-22101 Sensitive information leak through hidden menu

The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...

Uncontrolled Resource Consumption

Bouncy Castle for Java is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to unbounded iteration counts in CRMF/CMP password-MAC processing, which allows an attacker to supply a maliciously high iteration count and cause excessive resource consumption, potentially...

CVE-2026-41875

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

EUVD-2026-88741

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

CVE-2026-41875 Cross-Site Request Forgery in admin panel of Quick.Cart

Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visited by the admin, will automatically send a POST request that changes admin's login and password. This software does implement simple protection against this...

EUVD-2026-88577

mall4j through 4.0 contains a missing authentication vulnerability in the PUT /user/updatePwd endpoint that allows unauthenticated attackers to reset any storefront account password. Attackers can supply a target username in the request body to overwrite passwords without verification, enabling...

EUVD-2026-88567

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...