22 matches found
CVE-2026-121687
FrodoBots EarthRover Mini+ firmware version 6.2.46.2.50.614.0 contains several local interfaces that are exposed without authentication. 1. HTTP REST API port 80: motor control, telemetry/GPS/IMEI, plaintext WiFi password GET /api/v1/wifi/status, join-arbitrary-WiFi, diagnostic export. 2. ADB...
EUVD-2026-120092
FrodoBots EarthRover Mini+ firmware version 6.2.46.2.50.614.0 contains several local interfaces that are exposed without authentication. 1. HTTP REST API port 80: motor control, telemetry/GPS/IMEI, plaintext WiFi password GET /api/v1/wifi/status, join-arbitrary-WiFi, diagnostic export. 2. ADB...
CVE-2026-121687 CVE-2026-121687
FrodoBots EarthRover Mini+ firmware version 6.2.46.2.50.614.0 contains several local interfaces that are exposed without authentication. 1. HTTP REST API port 80: motor control, telemetry/GPS/IMEI, plaintext WiFi password GET /api/v1/wifi/status, join-arbitrary-WiFi, diagnostic export. 2. ADB...
CVE-2026-121687
The FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0 ) exposes several local interfaces without authentication, potentially allowing full local compromise. Vulnerable components include an HTTP REST API on port 80 (providing motor control, telemetry, and plaintext Wi-Fi passwords)...
CVE-2026-121687: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed…
FrodoBots EarthRover Mini+ firmware version 6.2.46.2.50.614.0 contains several local interfaces that are exposed without authentication. 1. HTTP REST API port 80: motor control, telemetry/GPS/IMEI, plaintext WiFi password GET /api/v1/wifi/status, join-arbitrary-WiFi, diagnostic export. 2. ADB...
PT-2026-140448
FrodoBots EarthRover Mini+ firmware version 6.2.4 6.2.5 0.614.0 contains several local interfaces that are exposed without authentication. 1. HTTP REST API port 80: motor control, telemetry/GPS/IMEI, plaintext WiFi password GET /api/v1/wifi/status, join-arbitrary-WiFi, diagnostic export. 2. ADB...
CVE-2024-58368
SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...
CVE-2024-58368: Uncaught Exception
SurrealDB versions before 1.1.0 fail to properly parse the ID, DB, and NS headers in HTTP REST API requests containing special characters. Unauthenticated attackers can send crafted HTTP requests with malformed header values to trigger an uncaught exception that crashes the server...
CVE-2026-12207 medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection
A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID...
CVE-2026-12207 medkey-org medkey HTTP REST API PatientController.php actionGetPatientById resource injection
A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID...
CVE-2026-12207: Improper Control of Resource Identifiers
A security flaw has been discovered in medkey-org medkey up to fc09b7ba9441ff590b72d428d5380834216b09ed. Impacted is the function actionGetPatientById of the file app\modules\medical\port\rest\controllers\PatientController.php of the component HTTP REST API. The manipulation of the argument ID...
CVE-2026-5632
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be...
EUVD-2026-19188
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be...
CVE-2026-5632
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be...
CVE-2026-5632 assafelovic gpt-researcher HTTP REST API Endpoint missing authentication
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be...
PT-2026-30571
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be...
CVE-2026-5632: Missing Authentication for Critical Function
A vulnerability was found in assafelovic gpt-researcher up to 3.4.3. This impacts an unknown function of the component HTTP REST API Endpoint. Performing a manipulation results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be...
Uncaught Exception processing HTTP Headers in SurrealDB
The ID, DB and NS headers accepted by the SurrealDB HTTP REST API would fail to parse when containing some special characters. This would cause a panic which would crash the SurrealDB server, leading to denial of service. This issue only affects the SurrealDB binary; it does not affect the...
GHSA-M24X-R6Q3-2VP9 Uncaught Exception processing HTTP Headers in SurrealDB
The ID, DB and NS headers accepted by the SurrealDB HTTP REST API would fail to parse when containing some special characters. This would cause a panic which would crash the SurrealDB server, leading to denial of service. This issue only affects the SurrealDB binary; it does not affect the...
PT-2024-40357
Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.1.0 Description The issue affects the SurrealDB HTTP REST API, where the ID, DB, and NS headers fail to parse when containing special characters, causing a panic that crashes the SurrealDB server, leading to denia...