30119 matches found
CVE-2026-72581 duhow xiaoai-patch - Server-Side Request Forgery in /auth Endpoint
A server-side request forgery SSRF vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to...
CVE-2026-66409
DEEBOT PRO M1 and DEEBOT PRO K1VAC are configured with weak passwords for their Wi-Fi hotspot networks. The password may be analyzed and obtained to connect to the access point of an affected robot...
Photon OS 5.0: Python3 PHSA-2025-5.0-91-0595
An update of the python3 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0595. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
VulnCheck KEV: CVE-2026-59310
Broadcom VMware vCenter contains a path traversal vulnerability which could allow a threat actor with network access to vCenter to execute arbitrary code...
Photon OS 5.0: Curl PHSA-2026-5.0-91-0856
An update of the curl package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2026-5.0-91-0856. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Consul PHSA-2023-5.0-91-0053
An update of the consul package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-91-0053. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Influxdb PHSA-2023-5.0-92-0009
An update of the influxdb package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-5.0-92-0009. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
Photon OS 5.0: Krb5 PHSA-2024-5.0-92-0284
An update of the krb5 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-92-0284. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...
PT-2026-69953
Name of the Vulnerable Software and Affected Versions TrustyAI Service affected versions not specified Description A flaw in the TrustyAI Service TAS deployment allows any pod on the cluster network to bypass authentication and directly access the TAS backend API. This could enable an attacker to...
PT-2026-69958
Name of the Vulnerable Software and Affected Versions ml-metadata affected versions not specified Description An outdated statically-linked gRPC stack in ml-metadata is susceptible to HTTP/2 denial of service DoS issues. An attacker with network access to the MLMD pod can send specially crafted...
CVE-2026-19352
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...
CVE-2026-19352 mifi lossless-cut Built-in HTTP API Service httpServer.ts server-side request forgery
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...
EUVD-2026-54920
A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...
CVE-2026-56848
A heap use-after-free vulnerability in the Node.js HTTP/2 component allows a remote attacker to crash the application, causing a denial of service. This is triggered by an unexpected re-entrant call to nghttp2sessionmemsend while nghttp2sessionmemrecv is still executing. Mitigation Restrict netwo...
EUVD-2026-54322
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54314
Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network...
EUVD-2026-54312
Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54321
Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network...
EUVD-2026-54216
An authentication issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials...
