3445 matches found
CVE-2026-24429: Use of Default Password
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 ship with a predefined default password for a built-in authentication account that is not required to be changed during initial configuration. An attacker can leverage these default credentials to gain authenticated acce...
CVE-2025-11065: Generation of Error Message Containing Sensitive Information
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...
CVE-2026-24439: Improper Encoding or Escaping of Output
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 fail to include the X-Content-Type-Options: nosniff response header on web management interfaces. As a result, browsers that perform MIME sniffing may incorrectly interpret attacker-influenced responses as executable...
CVE-2026-24431: Cleartext Storage of Sensitive Information in GUI
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials...
CVE-2026-24430: Insertion of Sensitive Information Into Sent Data
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface. Because the management interface is accessible over unencrypted HTTP by default, credentials may be expose...
PT-2026-4793
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials...
CVE-2026-24436: Improper Restriction of Excessive Authentication Attempts
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 do not enforce rate limiting or account lockout mechanisms on authentication endpoints. This allows attackers to perform unrestricted brute-force attempts against administrative credentials...
CVE-2026-24440: Unverified Password Change
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 allow account passwords to be changed through the maintenance interface without requiring verification of the existing password. This enables unauthorized password changes when access to the affected endpoint is obtained...
CVE-2026-24428: Incorrect Authorization
Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the administrator account password. By sending a crafted request directly to the backend endpoint, an...
CVE-2025-68907 WordPress Hostme v2 theme <= 7.0 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through = 7.0...
CVE-2025-68907: Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in AivahThemes Hostme v2 hostmev2 allows Path Traversal.This issue affects Hostme v2: from n/a through = 7.0...
CVE-2021-47858: Improper Neutralization of Input During Web Page Generation
Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'startaddr' parameter of the Security Management interface. Attackers can inject malicious scripts through the start source address field that will persist and trigger for privileged users when they...
MiracleLinux 8 : kernel-4.18.0-477.10.1.el8_8 (AXSA:2023-5865:16)
The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2023-5865:16 advisory. use-after-free caused by l2capreassemblesdu in net/bluetooth/l2capcore.c CVE-2022-3564 net/ulp: use-after-free in listening ULP sockets CVE-2023-046...
MiracleLinux 7 : kernel-3.10.0-1160.119.1.0.6.el7.AXS7 (AXSA:2024-9046:38)
"The remote MiracleLinux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2024-9046:38 advisory. net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink CVE-2024-44970 PCI: Add missing bridge lock to pcibuslock CVE-2024-46750 net/mlx5: Discard...
Malicious Package
Overview focus-trap-v2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview tailwind-merge-v2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in focus-trap-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54f9667b65219caefb7d526b0ab3787b23c76689e9858e281ce10c5a744ffd10 The package focus-trap-v2 was found to contain malicious code. Source: ghsa-malware e80cecdd51ca03a6a75b249c73d4a4efda03c84e9bdc4a1ba3b2b66cbfd8c82d...
EUVD-2026-3072
Malicious code in focus-trap-v2 npm...
MAL-2026-285 Malicious code in focus-trap-v2 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54f9667b65219caefb7d526b0ab3787b23c76689e9858e281ce10c5a744ffd10 The package focus-trap-v2 was found to contain malicious code. Source: ghsa-malware e80cecdd51ca03a6a75b249c73d4a4efda03c84e9bdc4a1ba3b2b66cbfd8c82d...