CVE-2026-107153

Multiple smartphones provided by Rakuten Mobile, Inc. are vulnerable because they utilize AOSP test keys for their Android Verified Boot (AVB) functionality. If an attacker has physical access to an affected device, they may be able to install a crafted system image . No specific remediation or e...

CVE-2025-65320

CVE-2025-65320 CVE-2025-65320: Cleartext Storage of Sensitive Information in Memory in Abacre Restaurant Point of Sale POS. All versions of Abacre Restaurant Point of Sale POS up to 15.0.0.1656 are vulnerable to Cleartext Storage of Sensitive Information in Memory. The application leaves valid...

gitea-git-redir-ssrf

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · gitea-git-redir-ssrf gitea-git-redir-ssrf Gitea 1.27.3 - Gitea IsMigrateURLAllowed is a one-shot net.LookupIP on the URL you typed. Bytes then go through git clone --mirror. HandleGitCmdHTTPRedirection is supposed to...

PT-2026-113642

Multiple smartphones provided by Rakuten Mobile, Inc. utilize AOSP test keys for their Android Verified Boot AVB functionality. With physical access to the affected device, a crafted system image may be installed...

CVE-2026-110208

Wukong AICRM versions through 20260610 are vulnerable to a missing authorization flaw in the /systemConfig controller. This vulnerability allows any authenticated user to access sensitive AI provider API keys in cleartext. Specifically, an attacker can perform a GET request to /systemConfig/byTyp...

CVE-2026-110208 Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

CVE-2026-110208 Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys

Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for the cleartext key, or send a chosen apiUrl to...

rtx-cve-2023-45779

This repository is provided AS IS to accompanya Meta Red Team X vulnerability disclosure. It is not an official Meta project and will not be supported like one. A set of scripts and artifacts that demonstrate detection and exploitation of Android devices that ship APEXes signed with test keys fro...

CVE-2026-110123

Makunet maku-boot versions 4.3.0 through 5.0.0 are affected by a missing authorization vulnerability. Authenticated users can bypass authority checks by calling the /sys/mail/config/list and /sys/sms/config/list endpoints. This flaw allows attackers to retrieve sensitive information, including un...

DEBIAN-CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-65198

Huawei's openUBMC ships a default SNMPv3 USM key that uses one value for both authentication and privacy. An attacker who holds the key recoverable from the open-source build can authenticate SNMPv3 to, and decrypt SNMPv3 traffic from, any unit that still carries the shipped key. The build...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-105460

A flaw was found in BlueZ. An out-of-bounds read vulnerability exists in the btmon Bluetooth monitor tool when processing crafted HCI Return Link Keys events. A maliciously crafted btsnoop capture file can specify a large number of link keys that exceeds the actual packet data, causing btmon to...

CVE-2026-109965

Serena versions before 2.0.0 are vulnerable to an improper link resolution vulnerability (CWE-59). The root cause is that Project.is_path_in_project() normalizes paths lexically without resolving symlinks. This allows an attacker to commit symlinks inside a repository to access, read, or overwrit...

CVE-2026-41490

CVE-2026-41490 — SQL Injection in Dagster database I/O managers via dynamic partition keys Severity : High CVSS 8.3 CWE : CWE-89 — SQL Injection Affected : Dagster core = 1.13.0 and integration packages = 0.29.0 Fixed in : Dagster core 1.13.1 and integration packages 0.29.1 Advisory :...

CVE-2026-109244

A flaw was found in FreeRDP. The winpr-makecert utility creates unencrypted private key and certificate archive files without restricting permissions to the file owner, and it assigns a hardcoded default password to exported archives. A local user on a multi-user system can exploit this flaw to...

UAC-Elevation-CVE

CVE-2021-31956: Windows UAC Elevation of Privilege Exploit Overview CVE-2021-31956 is a UAC User Account Control bypass vulnerability in Windows that allows an attacker to elevate privileges to SYSTEM without triggering a UAC prompt. This CVE exploits a flaw in the way Windows handles registry ke...

USN-8916-1: PyJWT vulnerabilities

YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. This issue only affected Ubuntu 26.04 LTS. CVE-2026-102266 Rohan Das discovered that PyJWT incorrectly handled...

USN-8916-1 pyjwt vulnerabilities

YuSung Han discovered that PyJWT did not properly validate certain JWK keys when performing HMAC verification. An attacker could possibly use this issue to forge authentication tokens. This issue only affected Ubuntu 26.04 LTS. CVE-2026-102266 Rohan Das discovered that PyJWT incorrectly handled...