6244 matches found
CVE-2026-5993
A vulnerability was identified in Totolink A7100RU 7.4cu.2313b20191024. This vulnerability affects the function setWiFiGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument wifiOff leads to os command injection. The attack can be executed...
CVE-2026-5962
A vulnerability was detected in Tenda CH22 1.0.0.6468. This issue affects the function R7WebsSecurityHandlerfunction of the component httpd. The manipulation results in path traversal. The attack may be launched remotely. The exploit is now public and may be used...
EUVD-2026-20862
A vulnerability was identified in Totolink A7100RU 7.4cu.2313b20191024. This affects the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument pptpPassThru leads to os command injection. Remote exploitation of the attack is possible...
CVE-2026-5832
Affects atototo api-lab-mcp up to 0.2.1. The vulnerability resides in src/mcp/http-server.ts (function analyze_api_spec/generate_test_scenarios/test_http_endpoint) and stems from manipulating the argument source/url, enabling server-side request forgery. Exploitation is possible remotely, and the...
Rapid7 Velociraptor 安全漏洞
Rapid7 Velociraptor is a digital forensics and incident response platform provided by Rapid7, Inc. Versions of Rapid7 Velociraptor prior to 0.76.2 contained security vulnerabilities. These vulnerabilities stemmed from improper input validation in the client monitoring message processor running on...
CVE-2025-70364
CVE-2025-70364 affects Kiamo prior to 8.4 and allows authenticated administrative users to execute arbitrary PHP code on the server. The vulnerability is triggered by privileged admin access, with an impact of total compromise of confidentiality, integrity, and availability as per the CVSS vector...
CVE-2026-39620
Cross-Site Request Forgery CSRF vulnerability in priyanshumittal Appointment appointment allows Upload a Web Shell to a Web Server.This issue affects Appointment: from n/a through = 3.5.5...
The vulnerability of the ngx_http_mp4_module in NGINX open-source web servers allows a hacker to cause a service failure.
The vulnerability of the ngxhttpmp4module module in NGINX Open Source web servers is related to integer overflow. Exploiting this vulnerability can allow attackers to cause service failures...
CVE-2026-24146
NVIDIA Triton Inference Server contains a vulnerability where insufficient input validation and a large number of outputs could cause a server crash. A successful exploit of this vulnerability might lead to denial of service...
CVE-2026-24175
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a server crash by sending a malformed request header to the server. A successful exploit of this vulnerability might lead to denial of service...
CVE-2026-24147
NVIDIA Triton Inference Server contains a vulnerability in triton server where an attacker may cause an information disclosure by uploading a model configuration. A successful exploit of this vulnerability may lead to information disclosure or denial of service...
CVE-2026-35485 text-generation-webui has a Path Traversal in load_grammar() — arbitrary file read without authentication
text-generation-webui is an open-source web interface for running Large Language Models. Prior to 4.3, an unauthenticated path traversal vulnerability in loadgrammar allows reading any file on the server filesystem with no extension restriction. Gradio does not server-side validate dropdown value...
CVE-2026-5627 Path Traversal in mintplex-labs/anything-llm
A path traversal vulnerability exists in mintplex-labs/anything-llm versions up to and including 1.9.1, within the AgentFlows component. The vulnerability arises from improper handling of user input in the loadFlow and deleteFlow methods in server/utils/agentFlows/index.js. Specifically, the...
Text Generation Web UI 路径遍历漏洞
Text Generation Web UI is a local AI UI interface developed by oobabooga’s individual developers. Versions of Text Generation Web UI prior to 4.3 contained a path traversal vulnerability. This vulnerability stemmed from an unauthenticated path traversal vulnerability in the loadprompt function,...
CVE-2025-71058
CVE-2025-71058 affects Dual DHCP DNS Server 8.01, which improperly accepts and caches UDP DNS responses without validating they come from a configured upstream DNS server. The root cause is that responses are matched primarily by TXID and then inserted into the cache, allowing a remote attacker t...
budibase (>=0.0.3 <=0.0.31) potentially affected by CVE-2026-35214 via @budibase/server (>=0.0.1 <=0.0.9)
@budibase/server NPM version =0.0.1, =0.0.3, =0.0.31 Source cves: CVE-2026-35214 Source advisory: OSV:GHSA-2WFH-RCWF-WH23...
CVE-2025-59709
CVE-2025-59709 affects BizTalk360 up to version 11.5. The issue arises from mishandling user-provided input in a server-side path, enabling a Super User to read arbitrary files on the system and potentially coerce authentication, i.e., a Directory Traversal. The CVSSv3.1 metrics indicate a networ...
PT-2026-30046
An issue was discovered in Biztalk360 before 11.5. Because of incorrect access control, any user is able to request the loading a DLL file. During the loading, a method is called. An attacker can craft a malicious DLL, upload it to the server, and use it to achieve remote code execution on the...