300 matches found
CVE-2025-65855
CVE-2025-65855 HelpFlash IoT OTA Update Multiple Vulnerabilities Summary Multiple vulnerabilities in the OTA firmware update mechanism of Netun Solutions HelpFlash IoT allow an attacker with brief physical access to execute arbitrary code. CVE ID: CVE-2025-65855 Severity: HIGH CVSS v3.1 Score: 7....
EUVD-2026-123581
Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloudmanage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen, enabling arbitrary command execution as root over cleartext HTTP when an attacker is positione...
CVE-2026-126720: Rooxis Rooxis RXR-12: Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage,…
Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloudmanage, where a server-controlled JSON diagnoseParameter field is passed unsanitized to popen, enabling arbitrary command execution as root over cleartext HTTP when an attacker is positione...
EUVD-2026-116382
Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over...
CVE-2026-112354
Etrel INCH AC charging station management web interface prior to firmware versions 7.1.2 and 8.0.1 contains a hard-coded default credentials vulnerability that allows remote attackers to gain full Administrator access by authenticating with the factory-default account. Attackers can log in over...
PT-2026-136669
Name of the Vulnerable Software and Affected Versions Etrel INCH versions prior to 7.1.2 Etrel INCH versions prior to 8.0.1 Description The management web interface contains hard-coded default credentials. Remote attackers can authenticate using the factory-default account via cleartext HTTP to...
Authlib: Is_secure_transport() Loopback Exemption Can Be Bypassed With A Userinfo Component, Allowing Cleartext-HTTP URL
Summary "authlib.common.security.issecuretransport" is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback "http://" URIs. The check is implemented as a textual "str.startswith" prefix match, so ...
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...
GHSA-JJ7H-C3HG-M23X Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Summary authlib.common.security.issecuretransport is used throughout Authlib to enforce the OAuth 2.0 / OIDC requirement that endpoint and redirect URIs use TLS, with an RFC 8252 §7.3 exemption for loopback http:// URIs. The check is implemented as a textual str.startswith prefix match, so a URL...
Malicious code in @ppa-web-components/ppa-banner (npm)
Source: amazon-inspector bcf0b03540a27943a2afcc26927ce7256d85328bc4fcbc2562f36a88ad75ce8d @ppa-web-components/[email protected] is described as a 'Compatibility shim' but ships only two code paths: a no-op Proxy as its main export, and beacon.cjs. beacon.cjs defines BEACON =...
Malicious code in @ppa-web-components/ppa-hotel-collection (npm)
@ppa-web-components/ppa-hotel-collection is a dependency-confusion package: it is described as a "Compatibility shim", uses inflated version numbers, and its README calls it an "authorized dependency-confusion test". Each listed version 1.1.0, 1.0.0, 99.0.1, 2.0.1, 3.0.0 has a postinstall script...
Malicious code in @ecg-internal/media-util-js-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c716438d9014063b4616588b1522ba2de2f3cf4fd961212840ed6a324cced3da The package publishes to the public npm registry under the scoped name @ecg-internal/media-util-js-lib, which resembles an internal namespace. It shi...
MAL-2026-18210 Malicious code in @ecg-internal/media-util-js-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c716438d9014063b4616588b1522ba2de2f3cf4fd961212840ed6a324cced3da The package publishes to the public npm registry under the scoped name @ecg-internal/media-util-js-lib, which resembles an internal namespace. It shi...
CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...
CVE-2026-114614
The Authlib Python library (versions 0.13 through 1.8.0 ) is vulnerable due to a flaw in authlib.common.security.is_secure_transport() . The function uses a textual prefix comparison for loopback HTTP exemptions, which can be exploited if a URL's userinfo component begins with a loopback host whi...
CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...
CVE-2026-114614 Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.13 until 1.8.0, authlib.common.security.issecuretransport uses a textual prefix comparison for loopback HTTP exemptions, so a URL whose userinfo begins with a loopback host can be accepted even when its parsed host ...
Malicious code in css-svqggc-polyfill (npm)
Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry, and other namespace stubs, with a...
MAL-2026-17557 Malicious code in css-svqggc-polyfill (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b23cf39720388bcf9f26621bd52e256e18a011bf3b6821b7d9f5f60115b9663 Package masquerades as a CSS polyfill while impersonating internal Wix Thunderbolt registry modules thunderboltRegistry, siteAssetsRegistry,...