CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...

CVE-2026-73819 Ebyte NA111-M Weak Authentication

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...

EUVD-2026-68610

The affected Ebyte product's vendor configuration utility permits access to administrative functions without verifying the operator's identity under certain credential conditions. An unauthenticated attacker on the adjacent network could modify critical settings or change access credentials,...

CVE-2026-73819

Ebyte NE2-D11 (and NA111-M ) vendor configuration utility contains a weak authentication flaw: under certain credential conditions, administrative functions are accessible without verifying the operator's identity. An unauthenticated attacker on the adjacent network could modify critical settings...

CVE-2026-77975 Ebyte NA111-M Cleartext Storage of Sensitive Information

The affected Ebyte product exports administrative credentials and other sensitive configuration information without adequate protection. An unauthenticated attacker on the adjacent network who can obtain an exported configuration file could recover valid credentials and use them to access the...

EUVD-2026-68608

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2026-75133 Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via kbd_cron_process

Keep Backup Daily plugin for WordPress before 2.1.4 contains a sensitive information exposure vulnerability that allows unauthenticated attackers to trigger a full MySQL database dump by accessing the publicly exposed kbdcronprocess parameter without authentication. Attackers can predict the...

CVE-2025-61164

A flaw was found in Cohere North AI. This vulnerability allows for an information leak through its WebSocket Endpoint. A remote attacker could exploit this to gain unauthorized access to sensitive data. Mitigation Disable the affected WebSocket endpoint in the service configuration, or restrict...

FreeRDP: FreeRDP: Authentication bypass via incorrect RDSTLS PDU handling

A vulnerability in FreeRDP's server-side RDSTLS allows remote, unauthenticated attackers to bypass authentication. By sending a crafted capabilities PDU instead of the expected authentication request, an attacker can gain an authenticated session without valid credentials...

WordPress MemberHero plugin <= 6.9 - Unauthenticated Privilege Escalation to Administrator vulnerability

Unauthenticated Privilege Escalation to Administrator vulnerability discovered by Khaled Alenazi Nxploited in WordPress Plugin Simple User Registration versions = 6.9...

EUVD-2026-68465

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

CVE-2026-77013

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

EUVD-2026-68370

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

CVE-2026-68951

GROWI contains an incorrect authorization vulnerability. If this vulnerability is exploited, an unauthenticated attacker could retrieve the other user's bookmark data...

CVE-2026-58574

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a...

EUVD-2026-68368

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a...

CVE-2026-58574

Dell PowerStore is affected by a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface can read internal system information from the appliance filesystem. This may expose sensitive information and credent...

EUVD-2026-68366

The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms...

CVE-2026-51672

Incorrect access control in the getRoamingCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain the roaming enablement flag via sending a crafted POST request to /cgi-bin/cstecgi.cgi...