53219 matches found
CVE-2025-1960
CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interfa...
CVE-2025-1727
The protocol used for remote linking over RF for End-of-Train and Head-of-Train also known as a FRED relies on a BCH checksum for packet creation. It is possible to create these EoT and HoT packets with a software defined radio and issue brake control commands to the EoT device, disrupting...
CVE-2024-2012
vulnerability exists in the FOXMAN-UN/UNEM server / API Gateway that if exploited an attacker could use to allow unintended commands or code to be executed on the UNEM server allowing sensitive data to be read or modified or could cause other unintended behavior...
CVE-2024-2389
In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. An unauthenticated user can gain entry to the system via the Flowmon management interface, allowing for the execution of arbitrary system commands...
MAL-2026-125 Malicious code in kmeet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0007533264dfce09777a32ebaa374e6f78f7af5ea6d8df57d7a92ce22590a09e The package kmeet was found to contain malicious code. Source: ossf-package-analysis 6d1b109e5fb22408addfc93b1e1c172970312ae04f4b194bf5156abb941742ff...
Malicious code in kmeet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0007533264dfce09777a32ebaa374e6f78f7af5ea6d8df57d7a92ce22590a09e The package kmeet was found to contain malicious code. Source: ossf-package-analysis 6d1b109e5fb22408addfc93b1e1c172970312ae04f4b194bf5156abb941742ff...
Remote Code Execution (RCE)
feast is vulnerable to remote code execution RCE. The vulnerability is due to the use of yaml.load..., Loader=yaml.Loader to deserialize configuration YAML files before validation, which allows an attacker who can modify these files to instantiate arbitrary Python objects and execute OS commands ...
Unity Linux 20.1070e Security Update: kernel (UTSA-2026-000463)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000463 advisory. An issue was discovered in the Linux kernel before 4.20.15. The nfcllcpbuildtlv function in net/nfc/llcpcommands.c may return NULL. If the caller does not check for...
CVE-2025-14346
WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user...
CVE-2025-67397
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection...
SUSE CVE-2017-18886
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. It allows a bypass of restrictions on use of slash commands...
SUSE CVE-2017-18889
An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. An attacker could create fictive system-message posts via webhooks and slash commands, in the v3 or v4 REST API...
SUSE CVE-2025-11393
A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the cluster's main administrative credentials to any command it receives, instead of only the specific reports it is supposed to handle. This allo...
PT-2026-1445
Cayin Signage Media Player 3.0 contains an authenticated remote command injection vulnerability in system.cgi and wizard system.cgi pages. Attackers can exploit the 'NTP Server IP' parameter with default credentials to execute arbitrary shell commands as root...
CVE-2025-64424
CVE-2025-64424 affects Coolify up to v4.0.0-beta.434, enabling a low-privileged user to run commands as root via a command-injection in the git source input fields of a resource. Several connected sources corroborate the vulnerability class and affected components; remediation notes indicate fixe...
CVE-2025-67397
An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection...
CVE-2025-14346
WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user...
CVE-2025-14346
WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with the device and issue movement commands, override speed restrictions, and manipulate configuration profiles without any credentials or user...
CVE-2025-67397
Passy v1.6.3 is affected by CVE-2025-67397. A vulnerability allows a remote authenticated attacker to execute arbitrary commands through a crafted HTTP request using a specific payload injection, with impact reported as total (high risk). Root cause details are not fully disclosed in the provided...
