19893 matches found
CVE-2026-66403
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...
EUVD-2026-55110
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...
CVE-2026-66403
Affected products: ECOVACS DEEBOT PRO M1 and DEEBOT PRO K1VAC. The issue (CVE-2026-66403) is that a web server for debugging remains enabled, potentially allowing retrieval of stored floor maps and logs. Root cause per JVNDB entry is the debugging web server left active; no exploit details are pr...
Linux Distros Unpatched Vulnerability : CVE-2026-66738
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SPIP before 4.4.18 contains a code injection vulnerability in SQLite-backed installations. The navigation menu endpoint improperly handles array-typed user inpu...
CVE-2026-9030
A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...
CVE-2026-9031
An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web...
CVE-2026-9031
Summary: CVE-2026-9031 is an input validation vulnerability in the HTTP-WRITEOEM handler of the TP-Link Archer A6 web interface. The weakness stems from insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Impact (as documented): Successful ...
CVE-2026-9030 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6
A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...
EUVD-2026-54655
A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...
MAL-2026-13618 Malicious code in w-screenctl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3b2f241eacc2eaaaac28d2b9d76aeb67042a109869b28e45a88648bf937f856f When WScreenctl is invoked via the bundled g.mjs entry or the documented systemd/Task Scheduler service units, the package starts a Hapi HTTP server...
EUVD-2026-54210
sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...
CVE-2026-63725
sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...
CVE-2026-63725
The CVE describes an authenticated OS command injection in sysPass, where FileBackupService::doBackupFiles() constructs a tar command by directly inserting the config-provided backup path ($this->path) into the shell command without escaping or validation, and passes it to exec(). This path co...
CVE-2026-63725
sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...
CVE-2026-63725 sysPass FileBackupService Authenticated OS Command Injection via Backup Path
sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...
CVE-2026-63725 sysPass FileBackupService Authenticated OS Command Injection via Backup Path
sysPass's FileBackupService::doBackupFiles in lib/SP/Services/Backup/FileBackupService.php around line 388 builds a tar shell command by string-concatenating the backup directory path $this-path directly into the command line 'tar czf ' . $backupFileApp . ' ' . BASEPATH . ' --exclude "'...
CVE-2026-64677
Anki’s local HTTP server (prior to version 25.09.3) is vulnerable to directory traversal via unconstrained media and built-in data paths. Attackers could leverage scripts served from shared decks or malicious sites with an origin-check bypass to read local files. The issue is fixed in 25.09.3. Af...
CVE-2026-64677
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...
CVE-2026-64677
Removed by vendor...
CVE-2026-64677 Anki's local HTTP server is vulnerable to directory traversal attacks
Anki is a program for creating and reviewing flashcards. Prior to 25.09.3, endpoints in Anki's local HTTP server do not adequately constrain requested media and built-in data paths, allowing scripts served from shared decks, or malicious websites combined with an origin-check bypass, to read loca...