Lucene search
+L

45344 matches found

EUVD
EUVD
added 2 hours ago4 views

EUVD-2026-52640

The background service of ABP or AES runs as NT AUTHORITY\SYSTEM and implements a file-based inter-process communication IPC mechanism protected by AES encryption. Because the encryption key file is readable by standard users and protected using DPAPI. Any authenticated local user can recover the...

8.5CVSS5.6AI score
SaveExploits0References1
CVE
CVE
added 2 hours ago6 views

CVE-2026-18754

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added 2 hours ago3 views

EUVD-2026-52638

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score
SaveExploits0References1
CVE
CVE
added 2 hours ago5 views

CVE-2026-18753

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score
SaveExploits0References1
EUVD
EUVD
added 2 hours ago3 views

EUVD-2026-52637

The product firmware contains an embedded, static RSA private key utilized by the Lighttpd web server for TLS termination. Exposure of this private key allows malicious actors to breach the confidentiality and integrity of HTTPS communications, enabling traffic decryption and server spoofing...

9.1CVSS5.5AI score
SaveExploits0References1
CVE
CVE
added 3 hours ago5 views

CVE-2026-11366

The CVE concerns the WordPress plugin MonsterInsights prior to version 11.1.0. It fails to correctly validate the signature on an unauthenticated AJAX action when not connected to Google Analytics, leaving an empty HMAC signing key. This enables unauthenticated attackers to forge a valid signatur...

5.5AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 9 hours ago3 views

CVE-2026-11836

Insufficient verification of data authenticity in Caliptra Core ROM and Core Firmware validatedebugunlocktoken in subsystem mode allows an attacker with access to the integrator's debug unlock signing service to unlock production debug on an unintended device by presenting a valid token issued fo...

1.8CVSS5.5AI score
SaveExploits0References2Affected Software2
CVE
CVE
added 9 hours ago8 views

CVE-2026-11836

The CVE concerns Caliptra Core ROM and Core Firmware in subsystem mode, where validate_debug_unlock_token() fails to bind the token to a specific device. An attacker with access to the integrator’s debug unlock signing service can unlock production debug on an unintended device by presenting a va...

1.8CVSS5.5AI score
SaveExploits0References1
CVE
CVE
added yesterday11 views

CVE-2026-18737

Technical details are not publicly available in the provided documents. Monitor for updates.

7.1CVSS5.8AI score
SaveExploits0References3
EUVD
EUVD
added yesterday6 views

EUVD-2026-52434

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...

7.1CVSS5.8AI score
SaveExploits0References3
Cvelist
Cvelist
added yesterday19 views

CVE-2026-18654 Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

6.9CVSS
SaveExploits0References4
NVD
NVD
added yesterday8 views

CVE-2026-38447

osTicket 1.18.3 generates API keys using a predictable construction based on MD5 hashing. The use of MD5, combined with predictable inputs such as the current timestamp and client IP address, significantly reduces entropy. An attacker can approximate the key generation time and brute-force the ke...

9.8CVSS
SaveExploits1References4
NVD
NVD
added yesterday8 views

CVE-2026-18616

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

10CVSS
SaveExploits0References5
NVD
NVD
added yesterday10 views

CVE-2026-18615

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...

10CVSS
SaveExploits0References5
NVD
NVD
added yesterday9 views

CVE-2025-15629

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related...

6.9CVSS
SaveExploits0References3
EUVD
EUVD
added yesterday6 views

EUVD-2026-52414

A vulnerability was identified in GL-iNet GL-MT3000 up to 4.4.5. The impacted element is the function server.setpeer of the file /cgi-bin/glc of the component wg-server.so Native Plugin. The manipulation of the argument publickey leads to command injection. Remote exploitation of the attack is...

10CVSS7.3AI score
SaveExploits0References5
EUVD
EUVD
added yesterday7 views

EUVD-2026-52401

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...

10CVSS7.3AI score
SaveExploits0References5
CVE
CVE
added yesterday12 views

CVE-2026-18615

GL-iNet GL-MT3000 is affected through the wg-server.so Native Plugin glc, via the function wg-server.generate_publickey where manipulating the private_key argument leads to a command injection. The attack can be remote, and the exploit has been publicly disclosed. The provided documents do not sp...

10CVSS7.3AI score
SaveExploits0References5
Cvelist
Cvelist
added yesterday22 views

CVE-2026-18615 GL-iNet GL-MT3000 wg-server.so Native Plugin glc wg-server.generate_publickey command injection

A vulnerability was determined in GL-iNet GL-MT3000 up to 4.4.5. The affected element is the function wg-server.generatepublickey of the file /cgi-bin/glc of the component wg-server.so Native Plugin. Executing a manipulation of the argument privatekey can lead to command injection. The attack may...

10CVSS
SaveExploits0References5
Vulnrichment
Vulnrichment
added yesterday6 views

CVE-2025-15629 Weak Session Key Generation in TP-Link Omada Adoption Protocol

A cryptographic weakness exists in the Omada adoption protocol where session encryption keys used to protect communications between controllers and managed devices may be predictable due to insufficient entropy in session key generation. An attacker who successfully intercepts adoption-related...

6.9CVSS5.5AI score
SaveExploits0References3
Rows per page
Query Builder