CVE-2025-56801

CVE-2025-56801 Vulnerabilidad de generación de IV AES-CFB en la aplicación de escritorio de Reolink 1. Resumen Nombre : Aplicación de escritorio de Reolink Versión : 8.18.12 Vendedor : Reolink CWE : CWE-1204: Generación de vector de inicialización IV débil, CWE-321: Uso de clave criptográfica...

CVE-2026-71895

An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow users to authenticate directly to the...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

Wavlink WL-WN533A8 M33A8.V5030.190716 - Information Disclosure

An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials. id: CVE-2022-48164 info: name: Wavlink WL-WN533A8 M33A8.V5030.190716 - Information...

Trinity Audio <= 5.21.0 - Information Exposure

The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...

CVE-2026-76277

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edituser capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the...

EUVD-2026-94629

In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user that holds a role with the edituser capability could create a native Splunk username that ends with a period. The vulnerability is possible because username validation does not reject a trailing period before the...

ROS-20261005-73-0023

The vulnerability in rsync is related to incorrect input of configuration data. The vulnerability can be exploited remotely...

CVE-2023-2916

CVE-2023-2916 CVE-2023-2916 PoC WordPress 的 InfiniteWP Client 插件（版本至 1.11.1 及包括该版本）存在敏感信息泄露漏洞。该漏洞允许具有订阅者级别或更高权限的已认证攻击者提取包含配置详细信息在内的敏感数据。利用此漏洞的前提是插件尚未进行过配置。当与另一个任意插件安装和激活漏洞结合使用时，可能导致对站点的远程管理以及潜在的权限提升。...

Scout2

AWS Scout2 .. image:: https://travis-ci.org/nccgroup/Scout2.svg?branch=master :target: https://travis-ci.org/nccgroup/Scout2 .. image:: https://coveralls.io/repos/github/nccgroup/Scout2/badge.svg?branch=master :target: https://coveralls.io/github/nccgroup/Scout2 .. image::...

opencspm

OpenCSPM Open Cloud Security Posture Management（开源云安全态势管理，简称OpenCSPM）是一个开源平台，可帮助您深入了解云配置和元数据，从而随着时间的推移理解和降低风险。 OpenCSPM 面向谁？ 在云环境中运行基础设施的安全团队，希望全面了解整个账户的安全风险并跟踪问题的解决。 开发与基础设施团队，希望遵循一套安全最佳实践，在开发新系统时尽早并频繁地融入安全考量。 红队成员，希望针对自己的环境创建具有最高影响且对蓝队最有益的目标场景。 任何希望建立安全问题的基线、按风险进行优先级排序并跟踪直至最终解决的组织。 OpenCSPM 能做什...

CVE-2026-25049

🚨 CVE-2026-25049 – n8n 未授权设置泄露 📌 概述 CVE 编号： CVE-2026-25049 受影响软件： n8n 严重性： 严重 类别： 不当访问控制 / 信息泄露 该漏洞允许在某些 n8n 部署中通过 REST API 端点未授权访问 内部配置数据。 🧭 目录 概述 技术详情 影响 受影响版本 验证 缓解措施 安全说明 免责声明 🔍 技术详情 在易受攻击的配置中，以下端点无需身份验证即可访问： GET /rest/settings 📤 可能泄露的数据包括 🔐 身份验证方法（例如，电子邮件登录） 🌐 实例模式（例如，public） ⚙️ 功能开关和运行时设置 🧩...

ROS-20261002-73-0128

The vulnerability in perl-DBI is related to incorrect input of configuration data. The vulnerability can be exploited remotely...

The vulnerability of the Erlang/OTP software platform, related to incorrect input of configuration data, allows a hacker to trigger a service failure.

The vulnerability of the Erlang/OTP software platform is related to incorrect input of configuration data. Exploiting this vulnerability can allow a malicious actor to cause service failures...

The vulnerabilities of Cisco Secure Email and Web Manager, as well as Cisco Secure Email Gateway, stem from incorrect configuration data input. This allows attackers to trigger service failures.

The vulnerability of Cisco Secure Email and Web Manager, as well as Cisco Secure Email Gateway, is related to incorrect input of configuration data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

CVE-2026-88263

XikeStor Layer3 switches have a missing-authentication flaw that allows an unauthenticated attacker to download configuration data over the network. The retrieved data may contain network configurations and passwords , enabling an attacker to operate the switch improperly or use it as a jump host...

CVE-2026-88263: Missing Authentication for Critical Function

XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations and passwords to operate the affected product improperly or to exploit the affected product as a jump host...

PT-2026-93335

XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations and passwords to operate the affected product improperly or to exploit the affected product as a jump host...

The vulnerability of the authentication mechanism of the N-able N-central platform for monitoring and managing IT infrastructure allows a hacker to circumvent security restrictions.

The vulnerability of the authentication mechanism of the N-able N-central platform for monitoring and managing IT infrastructure is related to incorrect input of configuration data. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the getNimbusConf process. An attacker can obtain sensitive configuration data, including authentication payloads and keystore or truststore passwords, by making unauthorized requests to the...