CVE-2026-77056 Use of Default Credentials in boneIO

boneIO blackdebianimages ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access ...

CVE-2026-77056 Use of Default Credentials in boneIO

boneIO blackdebianimages ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access ...

CVE-2026-77056 Use of Default Credentials in boneIO

boneIO blackdebianimages ships with a Mosquitto MQTT broker that uses the same default credentials on all devices. These credentials are publicly documented on github, and there is no indication in the instructions to change them. A remote attacker can use them to gain full read and write access ...

CVE-2026-77056

The boneIO black_debian_images software is vulnerable to a Use of Default Credentials issue (CWE-1392) because the included Mosquitto MQTT broker uses identical, publicly documented default credentials across all devices. A remote attacker could exploit this to gain full read and write access to ...

Arbitrary Command Injection

Overview vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes without calling...

Arbitrary Command Injection

Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes without calling...

Arbitrary Command Injection

Overview org.webjars.npm:launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes without...

Arbitrary Command Injection

Overview launch-editor is a launch editor from node.js Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes without calling...

Arbitrary Command Injection

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Arbitrary Command Injection via the parseFile function in packages/launch-editor/index.js, which previously resolved file paths only after stripping position suffixes witho...

CVE-2026-92908

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

EUVD-2026-99213

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

CVE-2026-92908 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption to availability...

CVE-2026-92908

Adobe Commerce is affected by an Incorrect Authorization vulnerability (CWE-863) that enables a Security feature bypass . A low-privileged attacker can exploit this issue without user interaction to gain unauthorized read and write access , which may result in a limited disruption to availability...

SQL Injection

Overview @payloadcms/db-sqlite is a The officially supported SQLite database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticated...

SQL Injection

Overview @payloadcms/plugin-mcp is a MCP Model Context Protocol capabilities with Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticated attacker ca...

SQL Injection

Overview @payloadcms/db-postgres is a The officially supported Postgres database adapter for Payload Affected versions of this package are vulnerable to SQL Injection via improper escaping of string values in parseParams when constructing JSON queries for in and notin operators. An authenticated...

PT-2026-111872

🚨 CVE-2026-92908 Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access, causing a limited disruption...

User Interface (UI) Misrepresentation of Critical Information

Overview better-auth is a The most comprehensive authentication library for TypeScript. Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information via the deviceAuthorization plugin's GET /device endpoint, which omits the requesting clientid an...

CVE-2026-105786

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...

EUVD-2026-92876

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/src/models/ApplicationModel.ts accepts a caller-chosen application authorization identifier, applications/:id/confirm binds that identifier to a logged-in use...