EUVD-2026-77241

Missing authentication for critical function vulnerability exists in CPSL-08P1EN. If this vulnerability is exploited, an affected product may be operated by a remote attacker without authentication...

EUVD-2026-77231

An exposure of information through directory listing issue exists in CONPROSYS PAC Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...

ROS-20260914-73-0101

The vulnerability of the Password component in the Google Chrome browser is related to a flaw in data protection mechanisms. Exploiting this vulnerability could allow an attacker, operating remotely, to gain access to protected information through a specially created HTML page...

EUVD-2023-60666

A directory Traversal vulnerability in DataEase before 1.18.10 allows a remote attacker to obtain sensitive information via a a crafted request to the StaticResourceController.java component...

ROS-20260914-73-0066

The vulnerability of DevTools components in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain access to confidential data remotely...

The vulnerability of the requestBodyUploader component in the application programming interface of a git-based software platform, which facilitates collaborative code development on GitLab, allows an attacker to gain unauthorized access to protected information.

The vulnerability of the requestBodyUploader component in the application programming interface of a git-based software platform for collaborative code development on GitLab is related to an incorrect restriction on the path name to the directory. Exploiting this vulnerability may allow an attack...

The vulnerability of component E1 Foundation within the financial system module of the ERP system JD Edwards EnterpriseOne General Ledger, a business automation system developed by Oracle JD Edwards, allows a perpetrator to gain full control over this subsystem.

The vulnerability of component E1 Foundation in the financial management module of the JD Edwards EnterpriseOne General Ledger system, a business automation system, relates to insecure privilege management. Exploiting this vulnerability could allow an attacker, operating remotely, to gain full...

The vulnerability of the functional module of the SAP Solution Manager SAP Solution Tools Plug-In (ST-PI) allows a perpetrator to disclose protected information.

The vulnerability of the functional module of the SAP Solution Manager SAP Solution Tools Plug-In ST-PI is related to the absence of an authentication process. Exploiting this vulnerability can allow a malicious actor, operating remotely, to disclose sensitive information...

The vulnerability of Microsoft Fabric’s data management platform, related to the absence of authentication, allows attackers to escalate their privileges.

The vulnerability of the Microsoft Fabric data management platform is related to the absence of authentication. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The software’s vulnerability for providing secure remote access to data through the Palo Alto Networks GlobalProtect App allows a perpetrator to execute arbitrary commands.

The vulnerability of the software for providing secure remote access to data in the Palo Alto Networks GlobalProtect App is related to the use of an unreliable search path. Exploiting this vulnerability could allow a attacker to execute arbitrary commands...

The vulnerability of the user remote access agent for corporate resources and applications in Palo Alto Networks Prisma Access Agent allows a hacker to compromise the protected information.

The vulnerability of the user remote access agent for corporate resources and applications in Palo Alto Networks Prisma Access Agent is related to insufficient protection of sensitive data. Exploiting this vulnerability can allow attackers to disclose protected information...

The vulnerability of the SAP NetWeaver software integration platform, related to the failure to implement protective measures for SQL query structures, allows attackers to gain unauthorized access to protected information.

The vulnerability of the SAP NetWeaver software integration platform is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Azure AI Language Authoring service lies in the lack of authentication for critical functions, allowing attackers to escalate their privileges.

The vulnerability of Azure AI Language Authoring lies in the lack of authentication for a critical function. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

CVE-2026-79396

Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credentials in unencrypted plaintext within bin/config.xml and compiled into the Sofia executable, allowing remote attackers to gain full administrative control over...

CVE-2026-89263 MoguBlog through 6.2 Missing Authentication on the Comment Email-Notification Endpoint

MoguBlog through 6.2 fails to authenticate requests to the /web/comment/closeEmailNotification endpoint, allowing unauthenticated attackers to disable email notifications for arbitrary users. Remote callers can modify the startEmailNotification flag in Redis cache for any user identifier to...

CVE-2026-79394: Initialization of a Resource with an Insecure Default

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio fee...

Malicious code in logs_update (crates.io)

logs-update is a malicious crate published to crates.io on 2026-09-10 with zero downloads. It pretends to be a terminal progress-bar library, but renders nothing to a terminal. The whole crate steals files and sets up remote access. The crate has no build script, so it does not run during cargo...

CVE-2026-81468

Dell ThinOS 10, versions prior to 260510. 2616, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Command execution...

CVE-2026-81046

Dell ThinOS 10, versions prior to 260510.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context...

CVE-2026-81046

Dell ThinOS 10, versions prior to 260510.2616, contain a Protection Mechanism Failure vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Arbitrary Code Execution within the application context...