CVE-2026-102620

A flaw was found in Poppler. An integer overflow vulnerability in the TrueType font handling code can allow a local user to cause data corruption. By providing a specially crafted font file processed by the FoFiTrueType::cvtSfnts function, an attacker can cause improper data modification and...

CVE-2026-97934

A flaw was found in the Linux kernel. An unbounded memory copy vulnerability exists in the tracing subsystem when processing event histogram keys like STACKTRACE due to improper field pointer handling. A local user with access to the kernel tracing interface can exploit this flaw by setting a...

CVE-2026-76724

A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-76727

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-76728

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-76721

Buffer overflow vulnerability exists in the affected interface of HPE Networking Instant ON that could allow an unauthenticated remote attacker to run arbitrary code on the underlying host. Successful exploitation could allow an attacker to execute arbitrary code as a privileged user on the...

CVE-2026-100298

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation...

CVE-2024-31027

Cross Site Scripting vulnerability in Greek Universities Network GUnet Open eClass Platform v.3.15 allows a remote attacker to execute arbitrary code via the last name, first name, and username parameters in the user registration functionality...

CVE-2026-100298

Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 is vulnerable to a flaw where two user-information endpoints can reveal sensitive device and account details . This occurs under conditions not intended for normal operation. While the impact is rated as High for confidentiality, integrity, and avai...

EUVD-2026-89407

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

EUVD-2026-89405

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CVE-2026-100296 Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler...

CrushFTP_CVE-2025-54309

CVE-2025-54309 - CrushFTP Affected Versions 10.8.5 11.3.434 Race condition PoC by watchtower, adjusted to be more extensible. python crushedftp.py usage: crushedftp.py -h -u USERNAME -p PASSWORD -r REQUESTS -P PAYLOAD target CrushFTP CVE-2025-54309 XML Race Condition Exploit positional arguments:...

CVE-2026-76728 Authenticated Server-Side Request Forgery Leading to Remote Code Execution in HPE Networking Instant ON APs

A vulnerability in the API endpoint of HPE Networking Instant ON APs could allow an authenticated remote attacker with high privileges to conduct a server-side request forgery SSRF attack. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the...

CVE-2026-76728

A vulnerability exists in the API endpoint of HPE Networking Instant ON APs , where an authenticated remote attacker with high privileges can perform a server-side request forgery (SSRF) attack. Successful exploitation may enable the attacker to execute arbitrary commands as a privileged user on ...

CVE-2026-76727 Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-76727 Authenticated Command Injection Vulnerabilities in HPE Networking Instant ON

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

EUVD-2026-89346

Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-76724

A command injection vulnerability exists in the Command Line Interface (CLI) of HPE Networking Instant ON APs when accessed via the PAPI protocol . An unauthenticated adjacent attacker can exploit this by sending specially crafted packets to perform command injection. Successful exploitation allo...