CVE-2026-103098

The GV-Eye software is vulnerable to sensitive information exposure due to the transmission of a sensitive key within the URL query parameter over an unencrypted HTTP connection. Because the request is sent in plaintext rather than via HTTPS, an attacker capable of monitoring network traffic can ...

CVE-2026-96940: Weak Authentication

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network...

PT-2026-104063

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. affected versions not specified Description A sensitive key is transmitted in the URL over an unencrypted HTTP connection. Because the request uses HTTP instead of HTTPS, the key is sent in plaintext acro...

PT-2026-105474

High Package gomod github.com/siyuan-note/siyuan/kernel Affected versions 3.7.3 Patched versions none yet — leave blank until a fix is released Description Summary /ws/network/proxy is an admin-only WebSocket forward-proxy endpoint target URL and headers fully attacker-specifiable via query...

Unauthenticated path traversal vulnerability exists in the Brocade ASCG (CVE-2026-85487)

A path traversal vulnerability exists in the HTTP service component of Brocade ASCG versions before 3.5.0. An unauthenticated attacker on the local network could send a manipulated API request to the service endpoint bypassing path restrictions to arbitrary file read, file write, or file deletion...

Unauthenticated switch topology dump in Brocade ASCG before 3.5.0 (CVE-2026-87426)

An unauthenticated network-based attacker can query specific internal management endpoints on Brocade ASCG versions before 3.5.0 to enumerate the configuration details and state of managed Brocade Fabric OS FOS switches. This results in the unauthorized disclosure of the customer's SAN fabric...

CVE-2026-103958: Server-Side Request Forgery (SSRF)

Server-side request forgery in the tool server and remote agent connection handling in Loom for AWS before 1.7.0 might allow an authenticated remote user to obtain the credentials of the application's own container role and to read responses from arbitrary internal network locations, via a crafte...

Reversing the Clock: Layout-Aware Recovery of Design Intent from Clock Distribution Networks

Hardware reverse engineering supports competitive analysis and hardware assurance by recovering information about an integrated circuit IC from its physical implementation. While existing techniques primarily recover the gate-level netlist, which represents logical functionality, they often...

PT-2026-104419

Name of the Vulnerable Software and Affected Versions Loom for AWS versions prior to 1.7.0 Description An authenticated remote user can perform a Server-side request forgery SSRF through the tool server and remote agent connection handling. By providing a crafted connection address during the...

CVE-2026-82040: Server-Side Request Forgery (SSRF)

UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl that allows authenticated attackers to make the server send requests to arbitrary internal or cloud metadata hosts by supplying a malicious metadata URL to the...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

PCP: PCP: Denial of Service due to signed integer overflow

A signed integer overflow in the PCP pmGetPDU function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service DoS for subsequent packet reads...

GO-2026-6497 Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go

Blind SSRF via unvalidated Link header URL in pagination allows internal network probing in oras.land/oras-go...

CVE-2026-55394 Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2

Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...

CVE-2026-55394 Unencrypted 802.11 Network in Teledyne FLIR Robots running Aware2

Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...

EUVD-2026-91051

Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffing or hijacking network traffic...

CVE-2026-102667

The Joyland AI app is vulnerable to a JavaScript injection flaw in its WebView component, exploitable by an attacker with shared network access . The root cause allows unauthorized access to the clipboard , app-internal storage , and the ability to make arbitrary HTTP requests via the Weex 'strea...

CVE-2026-102667 Joyland AI WebView command injection

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

EUVD-2026-91025

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-84682 TDDPv2 setProductVer Command Injection in Archer AX90

A command injection vulnerability exists in the TDDPv2 service /usr/bin/tddp on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result...