605271 matches found
CVE-2026-76155
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...
CVE-2026-76157
Datiphy Data Management Center v8.3.0 through v8.5.1 has an unauthenticated upload API endpoint allowing remote attackers to upload arbitrary files, scoring CVSS 8.8 (HIGH) for integrity and availability impact. No exploitation evidence or patch details are provided; monitor the advisory at https...
CVE-2026-76156 Datiphy Data Management Center - Improper Neutralization of Special Elements used in an OS Command
OS command injection in the api endpoint of Datiphy Data Management Center from v8.3.0 through v8.5.1 allows an authenticated administrator to execute arbitrary operating system commands as root...
CVE-2026-76155
Datiphy Data Management Center versions v8.3.0 through v8.5.1 ship with default administrator credentials, enabling unauthenticated remote attackers to gain full administrative access. CVSS 9.3 CRITICAL; no patch or exploitation evidence provided in documents. Upgrade to a patched version or chan...
CVE-2026-76155 Datiphy Data Management Center - Use of Default Credentials
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...
EUVD-2026-63795
Use of default credentials in Datiphy Data Management Center from v8.3.0 through v8.5.1 allows a remote attacker to gain administrative access to the management platform by logging in with default administrator credentials...
CVE-2026-43679
This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...
CVE-2026-43679
This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...
EUVD-2026-63777
This issue was addressed with improved permissions checking. This issue is fixed in watchOS 26.4. An attacker with physical access to a locked Apple Watch may be able to view user contacts...
CVE-2026-43679
CVE-2026-43679 is a permissions-checking flaw in the FaceTime component of Apple Watch Series 6 and later . An attacker with physical access to a locked Apple Watch may be able to view user contacts. The issue was addressed with improved permissions checking and is fixed in watchOS 26.4 . The vul...
SUSE CVE-2026-76827
A flaw was found in search-indexer. This vulnerability allows a registered and authenticated managed cluster to tamper with or delete another cluster's indexed search data. This is possible because the delta-sync write paths in search-indexer do not properly restrict UPDATE/DELETE operations to...
EUVD-2026-63718
A critical bypass access control vulnerability has been reported in PTC Windchill Risk and Reliability WRR Enterprise Edition...
EUVD-2026-63757
SPIP before 4.4.20 allows unauthenticated remote attackers to execute arbitrary code, as exploited in the wild in August 2026. This is related to incorrect identification of ?php blocks, and varexport's mishandling of certain cases such as presence of a '' character...
EUVD-2026-63732
SitemapLoader.parsesitemap in langchaincommunity/documentloaders/sitemap.py applies the documented restricttosamedomain control only to leaf url entries. The loop over url elements filters cross-domain locations, but the loop over nested sitemap elements passes the child loc straight to...
EUVD-2026-63693
Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...
EUVD-2026-63730
The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next without checking the caller, and no customer-session middleware guards the route; the on...
EUVD-2026-63617
Improper input validation in Microsoft Office Word allows an unauthorized attacker to disclose information over a network...
EUVD-2026-63629
Server-side request forgery ssrf in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network...