242309 matches found
EUVD-2026-46416
A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...
EUVD-2026-46358
An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database...
CVE-2026-44878
A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...
CVE-2026-8982 Hard-coded / Backdoor Accounts
Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...
CVE-2026-16359
creationtimestamp| type| source ---|---|--- 2026-07-21 20:56:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mr6p27frgc24 2026-07-22 04:45:58+00:00| seen| https://www.hkcert.org/security-bulletin/mozilla-products-multiple-vulnerabilities20260722 2026-07-22 09:40:04+00:00| see...
CVE-2026-44878 Authenticated Path Traversal allows Unauthorized Access in Web Interface
A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...
CVE-2026-44878
CVE-2026-44878 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS. The vulnerability in the web-based management interface allows an authenticated, highly privileged remote attacker to access the device filesystem, with potential to read sensitive files and tamper with or delet...
EUVD-2026-41602
Gitea: SSRF via HTTP Redirect in Repository Migration...
GHSA-F75J-4CW6-RMX4 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
Summary The Gitea Docker images ship an app.ini template that hard-codes: REVERSEPROXYTRUSTEDPROXIES = The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted. When an admin enables ENABLEREVERSEPROXYAUTHENTICATION = true to p...
GHSA-25GQ-J9JX-43PG Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Summary The web handler EditReleasePost routers/web/repo/release.go reads form fields with prefix attachment-edit-uuid into a mapuuidnewName, passes that map to releaseservice.UpdateRelease, which writes the new name to the database via repomodel.UpdateAttachmentByUUID WITHOUT calling upload.Veri...
EUVD-2026-46399
Missing validation of the outer contenttype byte on TLS 1.3 encrypted records in s2n-tls allows an active man-in-the-middle to silently discard individual application data records without either endpoint detecting the modification. RFC 8446 Section 5.2 requires that the outer contenttype of all...
CVE-2026-44880
creationtimestamp| type| source ---|---|--- 2026-07-21 19:35:18+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr6kjqlhyq27 2026-07-22 14:55:18+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mraldxwopq2n...
GHSA-82F7-87HM-852X Gitea: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration
Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration Summary Gitea validates the user-supplied repository migration URL, but the actual clone and later mirror fetch operations are performed by the Git command-line client...
EUVD-2026-42325
Hono: API Gateway v1 adapter can drop a distinct repeated request header value during de-duplication...
CVE-2026-56579
HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security...
CVE-2026-56579 HCL MyCloud was affected with Exposure of Sensitive Information to an Unauthorized Actor.
HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security...
EUVD-2026-46342
HCL MyCloud was affected with License Key Revealed in HTTP Response. It may enable attackers to misuse the exposed information and compromise the application's security...
CVE-2026-47410
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal "dev-secret-change-me" when PLATFORMJWTSECRET is unset. A safety check exists but only...
CVE-2026-47410 praisonai-platform: JWT signing key defaults to hardcoded "dev-secret-change-me", allowing token forgery for any user when PLATFORM_ENV is unset
PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an insecure default cryptographic key. The JWT signing secret defaults to the hardcoded literal "dev-secret-change-me" when PLATFORMJWTSECRET is unset. A safety check exists but only...