323730 matches found
CVE-2026-51727
The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw within the SystemSettings function. An unauthenticated attacker can exploit this by sending a crafted POST request to /cgi-bin/cstecgi.cgi to retrieve sensitive administrative import a...
EUVD-2026-68714
Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83902
A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...
PT-2026-83931
Incorrect access control in the SystemSettings function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to retrieve administrative import and export endpoint information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83967
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view not change super admin-restricted module settings and leak the full module entity. Exploitation of...
CVE-2026-51671
The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the getCloudDownloadStatus function. This vulnerability allows unauthenticated attackers to obtain sensitive cloud firmware download state information by sending a crafted POST requ...
CVE-2026-51671
Incorrect access control in the getCloudDownloadStatus function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain cloud firmware download state information via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
PT-2026-83805
Incorrect access control in the getWiFiIpMacTable function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to obtain Wi-Fi client MAC-to-IP mappings via sending a crafted POST request to /cgi-bin/cstecgi.cgi...
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
RHEL 9 : osbuild-composer (RHSA-2026:61585)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:61585 advisory. A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building...
Amazon Linux 2 : microcode_ctl, --advisory ALAS2-2026-3872 (ALAS-2026-3872)
The version of microcodectl installed on the remote host is prior to 2.1-47. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3872 advisory. Improper handling of overlap between protected memory ranges for some IntelR XeonR 6 processors when using IntelR TDX...
MAL-2026-15626 Malicious code in fuels-forc (npm)
The package 'fuels-forc' was identified as containing malicious obfuscated code. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b993583bec4136d0b060dc6391c10e15f836e605b5b13b97dea6bb7a3dc1e5cd bin/cli.js runs whoami and reads os.hostname / os.platform, then POS...
Linux Distros Unpatched Vulnerability : CVE-2026-18705
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue in MongoDB Server's Atlas Vector Search feature could allow an authenticated user with read access to one view to retrieve documents from a different,...
Moderate: gzip security update
The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files containing the .gz extension, while retaining ownership modes, access, and modification times. Security Fixes: gzip: gzip: Arbitrary file overwrite via insecure...
MiracleLinux 9 : assertj-core-3.19.0-9.el9_8.1 (AXSA:2026-1706:01)
The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1706:01 advisory. assertj: AssertJ: Information disclosure and denial of service via XML External Entity XXE CVE-2026-24400 Tenable has extracted the preceding description blo...
RHEL 10 : gzip (RHSA-2026:61625)
The remote Redhat Enterprise Linux 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:61625 advisory. The gzip packages contain the gzip GNU zip data compression utility. gzip is used to compress regular files. It replaces them with files...
The vulnerability of the SVG component in Google Chrome and Microsoft Edge web browsers allows attackers to access confidential data.
The vulnerability of the SVG component in Google Chrome and Microsoft Edge relates to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data through a specially created HTML page...
CVE-2026-56718
creationtimestamp| type| source ---|---|--- 2026-08-30 20:46:48+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/gjr6e32eybwj7 2026-08-30 20:49:29+00:00| seen| https://bsky.app/profile/suriq.io/post/3mudbczrzqb2f 2026-08-30 23:22:56+00:00| seen|...