91033 matches found
CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...
CVE-2026-92770 Harbor through 2.15.2 Scanner Credential Disclosure via Query Parameter
Harbor through 2.15.2 fails to properly restrict the q query parameter filtering on scanner registration access credentials. Project administrators can exploit fuzzy filtering on the AccessCredential column to recover the scanner adapter secret one character at a time through response row counts...
augustus v0.14.30
Augustus - LLM vulnerability scanner for prompt injection, jailbreak, and adversarial attack testing Augustus - LLM Vulnerability Scanner Test large language models against 210+ adversarial attacks covering prompt injection, jailbreaks, encoding exploits, and data extraction. Augustus is a Go-bas...
CVE-2026-27561: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...
CVE-2026-27565: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...
CVE-2026-27564: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT request with admin credentials allowing execution of commands with root privileges on the device...
CVE-2026-27562: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT request with admin credentials allowing execution of commands with root privileges on the device...
CVE-2026-27559: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET request with user credentials allowing execution of commands with root privileges on the device...
CVE-2026-27553: Exposure of Sensitive System Information to an Unauthorized Control Sphere
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...
CVE-2026-27548: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddportinfo endpoint using user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27546: Authentication Bypass Using an Alternate Path or Channel
An unauthenticated remote attacker can exploit an authentication bypass in the accountlog function to log in as an admin, even when accounts are properly configured...
CVE-2026-27547: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27551: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...
CVE-2026-87113: Authorization Bypass Through User-Controlled Key
Tanium addressed an improper access controls vulnerability in Threat Response...
CVE-2026-27556: Improper Control of Filename for Include/Require Statement in PHP Program
A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/saveioddparameters endpoint using a valid operator cookie allowing execution of arbitrary PHP code on the device...
CVE-2026-27554: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/saveioddparameters endpoint using operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27549: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attacheddevicestab/doupload endpoint using operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27557: Path Traversal: '.../...//'
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...