CVE-2024-40617

CVE-2024-40617 Exploit PoC for CVE-2024-40617 Description See Medium publication for a detail description Fujitsu M2M GW1500 : From M2M to M2M2P0wn Usage | / | \ | | \ / \ | |/| | | ' \ | | | | | \ \ /\ / / ' \ | | | |/ /| | | | | |/ /| /| || |\ V V /| | | | || |||| || |||| / // || || usage:...

LiteLLM: M2M JWT Handler Has Improper Authorization

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

PYSEC-2026-4075 LiteLLM: M2M JWT Handler Has Improper Authorization

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/userapikeyauth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

PT-2026-105830

A vulnerability was identified in BerriAI litellm up to 1.82.2. This affects an unknown function of the file litellm/proxy/auth/user api key auth.py of the component M2M JWT Handler. Such manipulation leads to improper authorization. The attack can be launched remotely. A high complexity level is...

SUSE CVE-2026-89882

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTERREFPICSETPRED index underflow strefpicsetprediction computes the reference RPS index as strpsidx - deltaidxminus1 + 1 per HEVC spec equation 7-59. Both operands are u8, so when deltaidxminus1 + 1...

CVE-2026-89867 media: chips-media: wave5: Defer job_finish() only when a DEC_PIC was queued

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Defer jobfinish only when a DECPIC was queued Decoder instances sharing a VPU also share one v4l2m2m job slot, released when the running context calls v4l2m2mjobfinish. While draining, devicerun defers...

PT-2026-93508

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the wave5 media driver where decoder instances sharing a VPU also share a single v4l2 m2m job slot. During the draining process, the device run function defers the v4l...

CVE-2026-89882: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: hevc: guard INTERREFPICSETPRED index underflow strefpicsetprediction computes the reference RPS index as strpsidx - deltaidxminus1 + 1 per HEVC spec equation 7-59. Both operands are u8, so when deltaidxminus1 + 1...

Astra Linux – Vulnerability in Linux 5.10, Linux

In v4l2m2mquerybuf of v4l2-mem2mem.c, there is a possible out-of-bounds write due to improper input validation. This could lead to a local escalation of privileges, as the system requires execution privileges to exploit the vulnerability. User interaction is not required for exploitation. Product...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: A bug related to use after free was fixed due to errors in error path handling in mtkjpegdecdevicerun. In mtkjpegprobe, the variable &jpeg-jobtimeoutwork is bound to mtkjpegjobtimeoutwork. In mtkjpegdecdevicerun,...

CVE-2026-82774

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82775

An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...

CVE-2026-82773

Cross-site scripting vulnerability exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

CVE-2026-82775

An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...

EUVD-2026-77228

An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...

CVE-2026-82775

CVE-2026-82775 is an exposure-of-information vulnerability in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series (CONTEC). Accessing a specific URL allows a remote unauthenticated attacker to retrieve a directory listing, potentially revealing sensitive file or folder structure. The...

CVE-2026-82775

An exposure of information through directory listing issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. Accessing a specific URL on this product may allow a remote unauthenticated attacker to obtain the directory list without authentication...

CVE-2026-82774

CVE-2026-82774 is an OS Command Injection vulnerability affecting CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series devices. The root cause is improper neutralization of special elements in OS commands, allowing an authenticated attacker to execute arbitrary OS commands on the prod...

EUVD-2026-77227

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-82774

Improper neutralization of special elements used in an OS command 'OS Command Injection' issue exists in CONPROSYS M2M Gateway Series and CONPROSYS M2M Controller Series. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...