25254 matches found
CVE-2026-75775
Certain ASUS routers are vulnerable to an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements used in an OS command. A remote user can execute arbitrary commands with root privileges by sending crafted parameters to the router, specifically when the devi...
Jfrog Artifactory <6.17.0 - Default Admin Password
Jfrog Artifactory prior to 6.17.0 uses default passwords such as "password" for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. id: CVE-2019-17444 info: name: Jfrog Artifactory...
Netsweeper 4.0.5 - Default Weak Account
The Web Panel in Netsweeper before 4.0.5 has a default password of 'branding' for the branding account, which makes it easier for remote attackers to obtain access via a request to webadmin/. id: CVE-2014-9614 info: name: Netsweeper 4.0.5 - Default Weak Account author: daffainfo severity: critica...
CVE-2024-56071
🚨 Simple Dashboard = 2.0 - Unauthenticated Privilege Escalation 📄 Description The Simple Dashboard plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.0. This makes it possible for unauthenticated attackers to elevate their privileges to that of an...
frevvomapexec
frevvomapexec frevvomapexec is a script to verify the existence of a blind SQL injection vulnerability by injecting a delay of your choosing in seconds in Square 9 GlobalForms 6.2. To verify the vulnerability is legitimate, the end user will be required to do math e.g. Subtracting the smaller...
CVE-2023-26258-ArcServe
The TL; DR; If you are in the network you can scan for instances configured by default using ArcServeRadar.py. I tried to port it to C but couldn't, feel free to do it if you know how : c:\Users\vagrant\Desktoppython ArcServeRadar.py "Ethernet 2" 6969 192.168.56.20 -= ArcServe Finder - @TheXC3LL ...
CVE-2026-114663 Vyper 0.4.0b1 through 0.5.0b1 Name Shadowing of Imported Constants and Default Arguments
Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules, because parseName resolves their names in the using function's scope rather than at declaration. When a contract's parameter, local, or loop variable shares such a name,...
CVE-2026-114663
Vyper versions 0.4.0b1 through 0.5.0b1 are vulnerable to a name shadowing issue affecting unfoldable constants and omitted default arguments from imported modules. The root cause is that the parse_Name function resolves these names within the using function's scope instead of at the point of decl...
CVE-2026-103301
The Payment Gateway for Telcell WordPress plugin (versions before 2.0.5 ) is vulnerable to unauthenticated payment confirmation forgery . The root cause is an empty-by-default merchant secret used to sign incoming payment notifications, which the plugin fails to properly verify. An unauthenticate...
CVE-2026-103301 Payment Gateway for Telcell < 2.0.5 - Unauthenticated Payment Confirmation Forgery via Empty-Default Merchant Secret
The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment notifications, because the secret used to sign them is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary WooCommerce orders as pai...
GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...
A2A Java SDK has a fail-open default task authorization
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...
CLSA-2026-1792525290 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.18.9-tuxcare.3...
CLSA-2026-1792525288 TuxCare security update for @babel/plugin-proposal-export-default-from (2 CVEs)
TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 2 CVEs. Fixed in 7.16.7-tuxcare.2...
CLSA-2026-1792525287 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.21.0-tuxcare.4...
CLSA-2026-1792525284 TuxCare security update for @babel/plugin-proposal-export-default-from (1 CVE)
TuxCare rebuilt @babel/plugin-proposal-export-default-from to address 1 CVE. Fixed in 7.21.5-tuxcare.1...
Apache Axis2 Default Login
Apache Axis2, as used in dswsbobje.war in SAP BusinessObjects Enterprise XI 3.2, CA ARCserve D2D r15, and other products, has a default password of axis2 for the admin account, which makes it easier for remote attackers to execute arbitrary code by uploading a crafted web service. id: CVE-2010-02...
CLSA-2026-1792457914 TuxCare security update for @babel/plugin-syntax-export-default-from (1 CVE)
TuxCare rebuilt @babel/plugin-syntax-export-default-from to address 1 CVE. Fixed in 7.21.0-tuxcare.4...