CVE-2026-78578 Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful...

EUVD-2026-90982

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful...

CVE-2026-78578 Unauthenticated do Method Onboarding Connect Allows Wi‑Fi Reconfiguration Denial of Service Vulnerability in TP-Link Tapo C120 & C200

Tapo C120 v1 and C200 v5 do not enforce authentication for do method HTTPS onboarding connect actions after initial setup. An unauthenticated adjacent attacker can submit unauthorized wireless configuration parameters, causing the camera to attempt connection to a different network. Successful...

CVE-2026-102294 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

CVE-2026-102294 Authenticated OS Command Injection in TL-WR841N IPv6 WAN Configuration

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

CVE-2026-102294

The TP-Link TL-WR841N router is susceptible to an authenticated OS command injection vulnerability within the IPv6 WAN configuration . The root cause is the improper incorporation of a crafted IPv6 Gateway value into a system command. This allows an authenticated administrator to execute arbitrar...

EUVD-2026-90974

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

PYSEC-2026-4175 urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Impact urllib3 supports configuring TLS independently for an HTTPS proxy and the target server. proxysslcontext, proxyasserthostname, and proxyassertfingerprint configure the TLS connection to the proxy. sslcontext and the other target-specific TLS parameters configure the connection to the targe...

urllib3: HTTPS proxy TLS configuration may be ignored or overridden

Impacturllib3 supports configuring TLS independently for an HTTPS proxy and the target server.proxysslcontext, proxyasserthostname, and proxyassertfingerprint configure the TLS connection to the proxy. sslcontext and the other target-specific TLS parameters configure the connection to the target...

PYSEC-2026-4180 wlc may disclose API tokens to project-configured URLs

Impact wlc could send an unscoped API token to an unintended server when run inside a directory tree containing attacker-controlled project configuration. If .weblate, .weblate.ini, or weblate.ini defines an API url, and the user supplies a token with WLCKEY or --key without also pinning the URL,...

Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

SummaryExternal knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for other...

PYSEC-2026-4115 Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion

Summary External knowledge connections are created and owned by administrators, and are shared by every external knowledge base bound to them. Deleting an external knowledge base also removed that connection from the instance configuration, with no check on the caller's role and no check for othe...

CVE-2026-102826

A flaw was found in simple-git. The library fails to properly sanitize Git configuration directives passed through custom clone arguments, which allows Git to load an attacker-controlled configuration file. By specifying executable settings within that configuration, an attacker can achieve...

CVE-2026-56599

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

CVE-2026-56599 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

CVE-2026-56599 HCL BigFix Service Management is affected by multiple security vulnerabilities.

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

EUVD-2026-90878

HCL BigFix Service Management is affected by an Insecure Cookie Attribute Configuration vulnerability, which could allow an attacker to exploit missing security attributes such as SameSite, HttpOnly, Secure, and restrictive Paths, enabling Cross-Site Request Forgery CSRF, session hijacking via...

CVE-2026-56599

HCL BigFix Service Management is impacted by an Insecure Cookie Attribute Configuration vulnerability (CWE-614). The root cause is the absence of essential security attributes, including SameSite , HttpOnly , Secure , and restrictive Paths . This flaw could enable an attacker to perform Cross-Sit...

BIT-ELK-2026-78582 Missing Authorization in Kibana Leading to Unauthorized Deletion of Data

Missing Authorization CWE-862 in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Security Levels CAPEC-180. An authenticated user holding Synthetics privileges scoped to a single Kibana space could permanently delete Synthetics monitors that a...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to improper handling of inherited Object.prototype.headers during request configuration normalization, which allows an attacker with a separate prototype-pollution capability to inject attacker-controlled HTTP headers, including...