D-Link Router DNS Alteration

The vulnerability of the web interface of D-Link DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B routers lies in the lack of measures to neutralize specific elements. Exploiting this vulnerability can allow a remote attacker to alter DNS settings...

CVE-2020-36914

QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication credentials through cleartext cookie transmission. Attackers can perform man-in-the-middle attacks to capture and potentially misuse store...

CVE-2020-36914

CVE-2020-36914 affects QiHang Media Web Digital Signage 3.0.9. The issue is a sensitive information disclosure where authentication credentials can be intercepted because cookies are transmitted in cleartext, enabling potential MITM attackers to capture stored credentials. The sources consistentl...

CVE-2025-15237

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability...

CVE-2025-66648

A flaw was found in vega-functions. For sites that allow users to supply untrusted input, a remote attacker could exploit a vulnerability by maliciously using an internal function. This could lead to the execution of unintentional JavaScript, resulting in Cross-Site Scripting XSS. Mitigation...

PT-2026-1448

QiHang Media Web Digital Signage 3.0.9 contains a sensitive information disclosure vulnerability that allows remote attackers to intercept user authentication credentials through cleartext cookie transmission. Attackers can perform man-in-the-middle attacks to capture and potentially misuse store...

mcp library DoS

The vulnerability of the mcp library MCP Python SDK is related to an error in handling exceptional states. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

cpp-httplib Uncontrolled Resource Consumption DoS

The vulnerability of the cpp-httplib library is related to an uncontrolled resource consumption. Exploiting this vulnerability may allow a malicious actor, operating remotely, to cause service failures...

Unblu Spark File Upload

The vulnerability of the file upload function in the software platform used for audio and video calls in Unblu Spark relates to the ability to upload files of a dangerous type without restrictions. Exploiting this vulnerability allows an attacker who operates remotely to upload any type of files...

DICOM Orthanc Server Unauthorized Access

The vulnerability of the DICOM Orthanc server is related to insufficient protection of operational data. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

GHSA-2HC9-CC65-XWJ8 Duplicate Advisory: ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-95pq-hr8p-f5g7. This link is maintained to preserve external references. Original Description An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuratio...

CVE-2025-15239

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents...

EUVD-2026-0905

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents...

CVE-2025-15238 Quanta Computer｜QOCA aim AI Medical Cloud Platform - SQL Injection

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database contents...

CVE-2025-15237 Quanta Computer｜QOCA aim AI Medical Cloud Platform - Path Traversal

QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder names under the specified path by exploiting an Absolute Path Traversal vulnerability...

CVE-2025-15235

The CVE-2025-15235 entry concerns Quanta Computer’s QOCA aim AI Medical Cloud Platform, where a Missing Authorization flaw allows authenticated remote attackers to modify network packet parameters and access other users’ files. Affected component is the QOCA platform (no detailed version info pro...

CVE-2025-67303

An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in an insufficiently protected location that was accessible via the web interface...

PT-2026-1227

Name of the Vulnerable Software and Affected Versions QOCA aim AI Medical Cloud Platform affected versions not specified Description The QOCA aim AI Medical Cloud Platform, developed by Quanta Computer, contains a SQL Injection flaw. This allows authenticated remote attackers to inject arbitrary...

CVE-2025-67303

Prior to version 3.38 , ComfyUI-Manager contained an Unprotected Alternate Channel (CWE-420) vulnerability where configuration files were stored in an insufficiently protected directory accessible via the web interface. Remote attackers could manipulate critical data, modify security settings (e....

PT-2026-1293

Name of the Vulnerable Software and Affected Versions ComfyUI-Manager versions prior to 3.38 Description An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the application storing its files in a...