CVE-2018-18441-exploit

CVE-2018-18441-exploit D-Link DCS series Wi-Fi cameras expose sensitive information regarding the device configuration. The affected devices include many of DCS series, such as: DCS-936L, DCS-942L, DCS-8000LH, DCS-942LB1, DCS-5222L, DCS-825L, DCS-2630L, DCS-820L, DCS-855L, DCS-2121, DCS-5222LB1,...

cs4239-cve-2020-15873

CVE-2020-15873 Proof of Concept of CVE-2020-15873 - Blind SQL Injection in Librenms librenms librenms Development Debugging LibreNMS Docker Instance 1. Obtain a shell to the container: $ sudo docker exec -it librenmsvuln /bin/bash 2. To read the logs generated by LibreNMS: $ tail -f...

CVE-2026-105440: Extreme Networks Switch Engine (EXOS): Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an…

Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine EXOS allows an authenticated, low-privileged read-only user to execute CLI show commands that are restricted to that role through the command line interface. Successful exploitation results in disclosur...

CVE-2026-123180

A missing authentication vulnerability in the listed NETGEAR RAX models allows an network adjacent attacker who has authenticated to wifi network to obtain sensitive information and tamper with device configuration, including administrator credentials, without authenticating to the device. This...

CVE-2026-117471

Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to the Duo client without an allowlist or explicit timeout. An authenticated remote attacker could cause the server to connect to selected hosts over HTTPS on po...

CVE-2026-82945

SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of ECMAXFMMU entries. A device...

EUVD-2026-109678

SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of ECMAXFMMU entries. A device...

PT-2026-123210

SOEM version 2.0.0 and earlier contains a vulnerability during device configuration where a malicious device can cause memory corruption. The software writes configuration data to a fixed-size array without checking if the array index exceeds its maximum size of EC MAXFMMU entries. A device...

RT-Labs AB SOEM buffer error vulnerability

RT-Labs AB’s SOEM 2.0.0 and earlier versions contain a security vulnerability. This vulnerability arises when configuration data is written to a fixed-size array during device configuration; no check is performed to ensure that the array index does not exceed the maximum number of ECMAXFMMU...

CVE-2026-101954

An Improper Authentication vulnerability in the J-Web management interface and its NETCONF session handling of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated network attacker to obtain root-level device configuration access and take over the device via a reachable J-Web...

CVE-2026-101954

Juniper Networks Junos OS and Junos OS Evolved are affected by an Improper Authentication vulnerability (CWE-287) in the J-Web management interface and its NETCONF session handling . An unauthenticated network attacker can exploit a reachable J-Web HTTP or HTTPS service to obtain root-level devic...

EUVD-2026-101337

Lantronix XPress-DR and XPress-DR-I CoBos-family firmware through 8.1.0.0 contains a missing authentication vulnerability that allows remote attackers to read and persistently overwrite device configuration by sending crafted frames to the unauthenticated UDP configuration protocol on port 30718...

Rockwell Automation 1732E ArmorBlock authorization issue vulnerability

Rockwell Automation’s 1732E ArmorBlock versions 3.012 and earlier have an authorization issue vulnerability. This vulnerability stems from a lack of authentication when changing the device webserver password. Unverified attackers can modify the password without valid credentials, potentially...

CVE-2026-104076

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints. Attackers can send...

EUVD-2026-95251

TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain a missing authentication vulnerability that allows remote unauthenticated attackers to read sensitive device information and modify device configuration via unprotected REST API endpoints on port 8288. Attackers...

CVE-2026-102294: Improper Neutralization of Special Elements used in an OS Command

TP-Link TL-WR841N contains an authenticated OS command injection vulnerability in the IPv6 WAN configuration. A crafted IPv6 Gateway value is improperly incorporated into a system command, allowing an authenticated administrator to execute arbitrary operating system commands. Successful...

CVE-2026-90184: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

CVE-2026-73125

Ebyte NE2-D11 devices are affected by a missing authentication flaw in the web management interface . The interface does not consistently enforce authentication before granting access to administrative functionality, allowing an unauthenticated remote attacker to read sensitive configuration data...

CVE-2026-73125 Ebyte NA111-M Missing Authentication for Critical Function

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability...

FURUNO ELECTRIC FA-50 CLASS B AIS TRANSPONDER uses hard-coded credentials and misses authentication for additional configuration

Overview FA-50 CLASS B AIS TRANSPONDER provided by FURUNO ELECTRIC CO., LTD. contains the following vulnerabilities. Use of hard-coded credentials CWE-798 - CVE-2026-59769 The CVSS evaluation above assumes that an attacker who knows the credentials and has access to the network to which the devic...