SUSE CVE-2026-67415

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.9 and 4.3.3, the Shovel parameter parser converted attacker-controlled runtime parameter values into non-garbage-collected Erlang atoms before bounding them or checking a fixed allowlist. Exploitation requires network access to th...

SUSE CVE-2026-97980

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364

The mall4j framework (through version 4.0 ) contains an improper authentication vulnerability because it fails to validate the sysType field in sa-token sessions. This flaw allows storefront customers to authenticate as back-office users by reusing their own session tokens. An attacker who regist...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-102364 mall4j through 4.0 Improper Authentication Accepts Storefront Tokens on Admin API

mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office users by reusing their session tokens. Attackers can register on the public storefront and use their customer session token to access admin endpoints lacking...

CVE-2026-101261

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetupwifi. Executing a manipulation of the argument loginpwd can lead to command injection. The attack may be performed from remote. The exploit has been published and may be used. Th...

CVE-2026-102334

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-101262

A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/setonlineclient. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publi...

CVE-2026-101260

A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to be carried out remotely. The exploit...

CVE-2026-101264

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw is located in an unknown function within the /api/ZRnetwork/set_passwd file, where manipulation of the password1 argument allows for remote execution. The exploit has been publicly disclosed and may be utili...

CVE-2026-101264 Ziroom ZHOME A0101 set_passwd command injection

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/setpasswd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-101264 Ziroom ZHOME A0101 set_passwd command injection

A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/setpasswd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be...

CVE-2026-101263 Ziroom ZHOME A0101 set_online_client command injection

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/setonlineclient. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could b...

CVE-2026-101263 Ziroom ZHOME A0101 set_online_client command injection

A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/setonlineclient. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The exploit has been made public and could b...

CVE-2026-101263

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw resides in the processing of the /api/ZRQos/set_online_client file, where manipulating the mac argument allows for remote command execution. While the vendor has not responded to the disclosure, the exploit ...

CVE-2026-101262

A command injection vulnerability exists in Ziroom ZHOME A0101 version 1.0.1.0 . The flaw resides in the set_online_client functionality located at the /api/ZRQos/set_online_client endpoint. By manipulating the ip argument, a remote attacker can execute arbitrary commands. The exploit has been pu...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...

CVE-2026-102334 Nginx Proxy Manager through 2.16.0 Missing Brute-Force Protection

Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited password guesses against any account. Attackers can brute-force login credentials via POST /api/tokens and subsequently guess TOTP codes via POST /api/tokens/2f...