CamTRON

CamTRON - Escáner de Cámaras Una herramienta automatizada para detectar dispositivos de vigilancia cámaras en redes. Características Detección multimarca : Compatible con más de 30 marcas de cámaras, incluyendo Hikvision, Dahua, Axis, CCTV y más Escaneo de alto rendimiento : Escaneo concurrente c...

Meari IoT Cloud Platform OpenAPI Service (Update A)

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. 2. RECOMMENDED...

PT-2026-105084

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

PT-2026-105087

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

PT-2026-105069

Improper handling of highly compressed data data amplification in ASP.NET Core allows an unauthorized attacker to deny service over a network...

PT-2026-103952

Name of the Vulnerable Software and Affected Versions Tapo C120 v1 Tapo C200 V5 Description Insufficient protection of login challenge data and lack of sanitization of attacker-controlled input processed by the MacTool handler allow an unauthenticated attacker on the same local network to replay...

PT-2026-104070

Name of the Vulnerable Software and Affected Versions Meari IoT Cloud Platform OpenAPI Service affected versions not specified Description An authorization flaw exists in the OpenAPI Service that allows authenticated users to access the complete device shadow of any device. By specifying a device...

AlmaLinux 9.2 [TuxCare] Security Update: edk2-aarch64 / edk2-ovmf / edk2-tools / edk2-tools-doc Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1764062286)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1764062286 advisory. - EDK2's Network Package is susceptible to a predictable TCP Initial Sequence Number. This vulnerability can be exploited by an...

CentOS Linux 7 [TuxCare] Security Update: java-11-openjdk / java-11-openjdk-debug / java-11-openjdk-demo / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1765310385)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1765310385 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

Rocky Linux 9.6 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-demo / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1779361233)

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779361233 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Serialization...

CentOS Linux 7 [TuxCare] Security Update: java-1.8.0-openjdk / java-1.8.0-openjdk-accessibility / etc Multiple Vulnerabilities (CENTOS7:CLSA-2024:1716915845)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2024:1716915845 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component:...

CentOS Linux 8.4 [TuxCare] Security Update: mysql / mysql-common / mysql-devel / mysql-errmsg / mysql-libs / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1768562086)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1768562086 advisory. - Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are...

PT-2026-105792

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the django.contrib.gis.gdal.GDALRaster constructor. Any value used in a spatial lookup against a GeometryField or...

CVE-2026-102667: Exposed Dangerous Method or Function

Joyland AI app allows an attacker with shared network access to inject JavaScript into content loaded in WebView. Without user-granted permissions, an attacker could access the clipboard, make arbitrary HTTP requests via the Weex 'stream' module, or access app-internal storage. If the installed a...

CVE-2026-84682: Improper Neutralization of Special Elements used in an OS Command

A command injection vulnerability exists in the TDDPv2 service /usr/bin/tddp on Archer AX90 V1. An unauthenticated adjacent-network attacker can exploit the setProductVer command handler to execute arbitrary operating system commands as root during device boot. Successful exploitation may result...

CVE-2026-9032: NULL Pointer Dereference

Tapo C120 v1 and C200 v5 contain a NULL pointer dereference in the HTTPS onboarding connect request parser. The interface is reachable without authentication after initial setup and does not validate that a password field is present for certain authentication and encryption parameter combinations...

CVE-2026-78577: Missing Authentication for Critical Function

Tapo C120 v1 and C200 V5 contain a vulnerability in the HTTPS onboarding scan function due to missing authentication. After initial setup, an unauthenticated attacker on the same local network can invoke the scan action and retrieve nearby wireless access-point metadata, including SSIDs, BSSIDs,...

CVE-2026-102369: Improper Authentication

Tapo C120 v1 and C200 V5 do not adequately protect login challenge data or sanitize attacker-controlled input processed by the MacTool handler. An unauthenticated attacker on the same local network can replay login challenge data to obtain an administrative session, enable a privileged service th...

CVE-2026-88789: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-67105: Cleartext Transmission of Sensitive Information

HCL BigFix Service Management is affected by an Insecure Communication vulnerability, which could allow an attacker with internal network access to intercept unencrypted HTTP traffic between backend services, enabling the extraction of sensitive data and potential man-in-the-middle MitM attacks...