Altenergy Power Control Software - SQL Injection

A vulnerability classified as critical was found in Altenergy Power Control Software up to 20241108. This vulnerability affects the function getstatuszigbee of the file /index.php/display/statuszigbee. The manipulation of the argument date leads to sql injection. The attack can be initiated...

ThinVNC - Authentication Bypass

ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via a specific command, potentially leading to unauthorized access and code execution. id: CVE-2022-25226 info: name: ThinVNC - Authentication Bypass author: ritikchaddha severity: critical description: |...

Cloudlog - SQL Injection

Cloudlog 2.6.15 contains a SQL injection caused by unsanitized input in oqrs.php requestform, letting attackers execute arbitrary SQL commands via stationid or callsign, exploit requires sending crafted request. id: CVE-2024-48259 info: name: Cloudlog - SQL Injection author: s4e-io severity: high...

Schneider Electric U.motion Builder - SQL Injection

The vulnerability exists within processing of trackimportexport.php in Schneider Electric U.motion Builder software versions prior to v1.3.4. The underlying SQLite database query is subject to SQL injection on the objectid input parameter. id: CVE-2018-7765 info: name: Schneider Electric U.motion...

ROOT-OS-UBUNTU-2204-CVE-2025-39823 CVE-2025-39823 in rootio-linux - Patched by Root

Root has patched CVE-2025-39823 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2024-56692 CVE-2024-56692 in rootio-linux - Patched by Root

Root has patched CVE-2024-56692 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2024-40972 CVE-2024-40972 in rootio-linux - Patched by Root

Root has patched CVE-2024-40972 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-45949 CVE-2026-45949 in rootio-linux - Patched by Root

Root has patched CVE-2026-45949 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2026-23303 CVE-2026-23303 in rootio-linux - Patched by Root

Root has patched CVE-2026-23303 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

ROOT-OS-UBUNTU-2204-CVE-2023-52935 CVE-2023-52935 in rootio-linux - Patched by Root

Root has patched CVE-2023-52935 in the rootio-linux package for Root:Ubuntu:22.04. Multiple fixed versions available...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-14540

creationtimestamp| type| source ---|---|--- 2026-07-31 03:54:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/eimuhra2zjnpt 2026-07-31 12:48:03+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrwygq2jw724...

CVE-2026-55502

Cloudreve prior to version 4.17.0 contains an OAuth scope bypass in the admin storage policy route POST /api/v4/admin/policy/oauth/signin. The admin route is under RequiredScopes(Admin.Read) and does not apply the local Admin.Write guard used by sibling policy mutation routes, allowing an attacke...

CVE-2026-14541

An authentication bypass and audience confusion vulnerability exists in the Google OAuth provider component of Google mcp-toolbox version 1.4.0. When a Google authService is initialized with mcpEnabled: true but lacks an explicitly defined audience or clientId, the ValidateMCPAuth pipeline for...

CVE-2026-6890

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

GHSA-MMJF-RQRV-855V vulnerabilities

Vulnerabilities for packages: promitor...

GHSA-64M9-QG9M-54W5 vulnerabilities

Vulnerabilities for packages: firefox...

GHSA-HVRP-RF83-W775 vulnerabilities

Vulnerabilities for packages: semgrep...

CVE-2026-14541

The CVE concerns Google mcp-toolbox version 1.4.0 in its Google OAuth provider component. If an authService is initialized with mcpEnabled: true but without an explicit audience or clientId, the ValidateMCPAuth pipeline for opaque tokens omits audience validation. This causes the toolbox to accep...

CVE-2026-61893

The CVE-2026-61893 entry concerns the MZ Automation lib60870 library. A crafted IEC 60870-5-104 I-frame with TypeID 104 (C_TS_NA_1) and an inflated object count causes TestCommand_getFromBuffer to read one byte past the end of the heap-allocated message buffer, indicating an out-of-bounds read in...