xtream-ui-security-audit

🔐 Xtream UI Security Audit & Exploitation Framework !Python...

PT-2026-5319

Name of the Vulnerable Software and Affected Versions VX800v version 1.0 Description A flaw exists in the application layer encryption of the web interface, allowing a nearby attacker to compromise the weak AES key and decrypt intercepted traffic. Exploitation requires network proximity and does...

PT-2026-5304

Name of the Vulnerable Software and Affected Versions Parsec versions prior to 3.6.0 Description Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, the libparsec crypto component does not check for weak order points of...

The vulnerability of SolarWinds IT infrastructure management software’s Web Help Desk system, related to deficiencies in authentication procedures, allows attackers to bypass security restrictions and execute arbitrary commands.

The vulnerability of the SolarWinds IT infrastructure management software’s Web Help Desk component is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary commands remotely...

Hono has an Arbitrary Key Read in Serve static Middleware (Cloudflare Workers Adapter)

Summary Serve static Middleware for the Cloudflare Workers adapter contains an information disclosure vulnerability that may allow attackers to read arbitrary keys from the Workers environment. Improper validation of user-controlled paths can result in unintended access to internal asset keys...

AZL-75500 CVE-2025-11065 affecting package kured for versions less than 1.14.2-7

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75369 CVE-2025-11065 affecting package podman 4.1.1-26

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75372 CVE-2025-11065 affecting package azl-otel-collector 0.127.0-1

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75425 CVE-2025-11065 affecting package cert-manager for versions less than 1.11.2-27

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75375 CVE-2025-11065 affecting package cri-o 1.30.1-1

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75548 CVE-2025-11065 affecting package skopeo for versions less than 1.14.4-8

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75554 CVE-2025-11065 affecting package prometheus for versions less than 2.37.9-7

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

AZL-75402 CVE-2025-11065 affecting package podman 5.6.1-10

A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in...

EUVD-2025-206352

Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint server running on port 1004 and 1005. This server is used for relaying status information from and to the Access Managers. This information, among other things, is used to graphically...

CVE-2026-1417

Removed by vendor...

Dormakaba Access Manager security vulnerabilities

The Dormakaba Access Manager is a smart hardware controller developed by the American company Dormakaba. There is a security vulnerability in the Dormakaba Access Manager, which stems from authentication based on the source IP address, potentially allowing IP address spoofing attacks to occur...

CVE-2026-1075

The ZT Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.4. This is due to improper nonce validation on the saveztcptcaptchasettings action where the nonce check can be bypassed by sending an empty token value. This makes it possibl...

CVE-2026-24556

Missing Authorization vulnerability in wpdive ElementCamp element-camp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ElementCamp: from n/a through = 2.3.2...

CVE-2026-24522

CVE-2026-24522 describes a Missing Authorization (broken access control) vulnerability in MyThemeShop WP Subscribe (wp-subscribe), affecting WP Subscribe versions up to 1.2.16. The CVSS 3.1 base score is 4.3 (Medium) with network attack, low exploit complexity, and low confidentiality impact. The...

CVE-2025-4320 Information Disclosure in Birebirsoft's Sufirmam

Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutions Sufirmam allows Authentication Bypass, Password Recovery Exploitation. This issue affects Sufirmam: through 23012026. NOTE: The vendor...