CVE-2026-19829

A security flaw has been discovered in 648540858 wvp-GB28181-pro 2.7.4-20260107. This vulnerability affects unknown code of the file LogController.java of the component Log File Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be launched...

CVE-2026-19828

CVE-2026-19828 affects 648540858 wvp-GB28181-pro version 2.7.4-20260107, specifically the Snapshot Endpoint’s PlayController.java. The vulnerability arises from manipulation of the deviceId/channelId argument, enabling path traversal. The attack can be remote, with a publicly available exploit (e...

EUVD-2026-58659

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19828 648540858 wvp-GB28181-pro Snapshot Endpoint PlayController.java path traversal

A vulnerability was identified in 648540858 wvp-GB28181-pro 2.7.4-20260107. This affects an unknown part of the file PlayController.java of the component Snapshot Endpoint. The manipulation of the argument deviceId/channelId leads to path traversal. The attack may be initiated remotely. The explo...

CVE-2026-19826

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

CVE-2026-19827

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDetailCat Endpoint. This manipulation of the argument executorAddress causes path traversal. It is possible to initiate the...

EUVD-2026-58658

A flaw has been found in alldatacenter alldata up to 0.6.8. This impacts the function FileInputStream of the file /admin/controller/JobLogController.java of the component logDetailCat Endpoint. This manipulation of the argument executorAddress causes path traversal. It is possible to initiate the...

CVE-2026-19827

CVE-2026-19827 affects alldatacenter alldata up to 0.6.8. The vulnerability concerns the FileInputStream usage in /admin/controller/JobLogController.java (logDetailCat Endpoint). Manipulation of the executorAddress argument enables path traversal, with remote exploitability. An exploit has been p...

CVE-2026-19826

A vulnerability was detected in alldatacenter alldata up to 0.6.8. This affects the function Hessian2Input.readObject of the file /serialize/impl/HessianSerializer.java of the component xxl-rpc Listener. The manipulation results in deserialization. The attack may be performed from remote. The...

EUVD-2026-58656

A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=saveservice. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotel...

EUVD-2026-58655

A weakness has been identified in Tenda W20E 15.11.0.610681546841CNTDC. The affected element is the function ipMacBindListStore of the file /goform/addIpMacBind. Executing a manipulation of the argument IPMacBindRule can lead to stack-based buffer overflow. The attack can be executed remotely. Th...

CVE-2026-19822

A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. T...

CVE-2026-73051

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit this through a front-end intermediary to desynchronize backe...

CVE-2026-73051

CVE-2026-73051 affects actix-http before 3.12.1. The HTTP/1.1 parser accepts requests with both Content-Length and Transfer-Encoding: chunked headers, enabling HTTP request smuggling. Unauthenticated remote attackers could use a front-end intermediary to desynchronize backend requests and smuggle...

CVE-2026-72817

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP Request.RemoteAddr using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the fir...

EUVD-2026-58628

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request with an empty Range header...

CVE-2026-19822

CVE-2026-19822 affects Tenda W20E (QoS Edit) where the function lstAdd in /goform/editQos can be coerced by manipulating qosListConnecttedNum, causing a stack-based buffer overflow. The issue may be exploitable remotely, and publicly available exploit details are noted. Exploitation status and pr...

EUVD-2026-58624

A vulnerability was identified in Tenda W20E 15.11.0.610681546841CNTDC. This issue affects the function lstAdd of the file /goform/editQos of the component QoS Edit. Such manipulation of the argument qosListConnecttedNum leads to stack-based buffer overflow. The attack may be launched remotely. T...

CVE-2026-19821

A vulnerability was determined in Tenda AC12 15.03.06.23multiTD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack ma...

EUVD-2026-58616

A vulnerability was determined in Tenda AC12 15.03.06.23multiTD01. This vulnerability affects the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg of the component httpd web management interface. This manipulation of the argument rebootTime causes buffer overflow. The attack ma...