97 matches found
KevinLAB BEMS (Building Energy Management System) - Backdoor Account
KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...
CVE-2026-89613
In the Linux kernel, the following vulnerability has been resolved: ntfs: reject invalid empty mapping pairs Reject an attribute with empty mapping pairs if it has inconsistent highest VCN and size...
EUVD-2026-52636
freo2 provided by refirio contains an unrestricted upload of file with dangerous type vulnerability. A user with the highest-level administrative privileges for the product may upload an executable file and execute arbitrary OS commands...
OpenSSL -- Multiple vulnerabilities
The OpenSSL project reports: Eighteen vulnerabilities in OpenSSL library. Highest classification High...
CVE-2026-46295
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Do IRR scan in kvmapicupdateirr even if PIR is empty Fall back to apicfindhighestvector when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt from the existing IRR. In a...
CVE-2026-46295
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Do IRR scan in kvmapicupdateirr even if PIR is empty Fall back to apicfindhighestvector when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt from the existing IRR. In a...
CVE-2026-46295 KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty
In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Do IRR scan in kvmapicupdateirr even if PIR is empty Fall back to apicfindhighestvector when PID.ON is set but PIR turns out to be empty, to correctly report the highest pending interrupt from the existing IRR. In a...
EfficientLab Controlio 代码问题漏洞
EfficientLab Controlio is a management software developed by EfficientLab for monitoring employee behavior and analyzing work efficiency. Versions of EfficientLab Controlio prior to 1.3.95 contained code vulnerabilities. These vulnerabilities were caused by weak permissions in the installation...
CVE-2026-32103
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.4.3, the POST /studiocmsapi/dashboard/create-reset-link endpoint allows any authenticated user with admin privileges to generate a password reset token for any other user, including the owner account...
CVE-2025-59106
The dormakaba access manager is vulnerable to a least privilege violation because the binary responsible for serving the web server and executing actions from the Web UI runs with root privileges . If an attacker successfully executes code on the system through other vulnerabilities, they could d...
EUVD-2024-2888
Malicious code in bioql PyPI...
EUVD-2025-15874
Malicious code in bioql PyPI...
EUVD-2023-44758
Malicious code in bioql PyPI...
EUVD-2024-32850
Malicious code in bioql PyPI...
EUVD-2022-53562
Malicious code in bioql PyPI...
An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely
...
CVE-2025-57685: Improper Neutralization of Special Elements used in a Command
The LB-Link routers, including the BL-AC2100AZ3 V1.0.4, BL-WR4000 v2.5.0, BL-WR9000AE4 v2.4.9, BL-AC1900AZ2 v1.0.2, BL-X26AC8 v1.2.8, and BL-LTE300DA4 V1.2.3 models, are vulnerable to unauthorized command injection. Attackers can exploit this vulnerability by accessing the /goform/setserialcfg...
CVE-2025-44635
There are multiple unauthorized remote command execution vulnerabilities in the H3C ER2200G2, ERG2-450W, ERG2-1200W, ERG2-1350W, NR1200W series routers before ERG2AW-MNW100-R1117; H3C ER3100G2, ER3200G2, ER3260G2, ER5100G2, ER5200G2, ER6300G2, ER8300G2, ER8300G2-X series routers before...
CVE-2025-3322
An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server...
CVE-2025-3322 Improper Neutralization of Special Elements in OnlineSuite
An improper neutralization of inputs used in expression language allows remote code execution with the highest privileges on the server...