CVE-2026-49199: Improper Neutralization of Special Elements used in a Command

Crafted MQTT messages can trigger command injection, resulting in root-level code execution on the target device...

CVE-2026-42929: Use of Hard-coded Credentials

Danelec MacGregor Voyage Data Recorder includes default accounts with hard-coded credentials...

CVE-2026-49376: Incorrect Authorization

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin...

CVE-2026-42500: Undefined Security Weakness

Decoding a paletted BMP file with an out-of-range palette index results in a panic when accessing pixels in the invalid image...

CVE-2026-49385: Missing Authorization

In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts...

CVE-2026-49380: URL Redirection to Untrusted Site

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible...

CVE-2026-49370: Insertion of Sensitive Information Into Sent Data

In JetBrains YouTrack before 2026.1.13162 information disclosure was possible on fetchApp requests...

CVE-2026-49367: Missing Authorization

In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account...

CVE-2026-49196: Improper Neutralization of Special Elements used in a Command

The Wi-Fi device blocking feature fails to sanitize MAC address input, allowing injection and execution of arbitrary shell commands...

CVE-2026-44611: Use of Password Hash With Insufficient Computational Effort

Danelec MacGregor Voyage Data Recorder passwords are stored with a hashing method which limits password length and is susceptible to brute force attacks...

web-vulnerability-scanner

web-vulnerability-scanner A P...

CVE-2026-46199: Out-of-bounds Read

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg Check bounds against the end of the BO whenever we access the msg...

CVE-2026-32998: Improper Handling of Parameters

This vulnerability in Veeam Service Provider Console allows for remote code execution...

CVE-2026-32996: Insertion of Sensitive Information into Log File

This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation...

CVE-2026-5343: Improper Check for Unusual or Exceptional Conditions

Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4...

CVE-2026-9646: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A reflected cross-site scripting issue exists in URL handling...

CVE-2026-9645: Improper Neutralization of Special Elements used in an OS Command

Exposed methods allow authenticated users to create and execute arbitrary JavaScript code on the server. The scripts execute with full access, enabling complete system compromise as commands are executed as root...

CVE-2026-9039: Initialization of a Resource with an Insecure Default

A configuration weakness in the device’s remote management service allows an authenticated session to be established over a communication channel intended solely for vehicle-charger signaling. The service is accessible on interfaces exposed through the charging connector, and it accepts a default...

CVE-2026-9037: Download of Code Without Integrity Check

A firmware update mechanism in the affected charging controller fails to validate the authenticity of firmware packages delivered through the device's management interface. Because cryptographic signatures are not verified, an attacker with the ability to interfere with or impersonate the...

CVE-2026-45353: Improper Control of Generation of Code

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. From 3.0.6 to 3.8.8, This vulnerability is fixed in 3.9.0...