Vtiger CRM v7.2.0 - Directory Listing

Vtiger CRM v7.2.0 contains a directory traversal vulnerability caused by improper access controls in /libraries and /layout directories, letting attackers display hidden files and list directories, exploit requires no authentication. id: CVE-2020-19363 info: name: Vtiger CRM v7.2.0 - Directory...

EUVD-2026-54715

OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backend binds an HTTP API to 127.0.0.1: commonly 19141 without server-side Origin validation, loopback authentication, or Content-Type...

CVE-2025-71409

The CVE-2025-71409 entry describes a lack of authentication for Very High Frequency Data Link CPDLC messages, allowing rogue ground stations to inject messages remotely over radio frequency. The root cause is missing auth for VHF Datalink CPDLC, which can lead to unexpected or misleading clearanc...

EUVD-2026-54437

Tobit Laboratories AG TeamDavid's Webbox 's sending email, fax, SMS, etc. functionality accepts a @@INCLUDE command, which can be set to network locations using UNC paths e.g., “\Server\Share”. The server processes these paths without validation, resulting in outbound connection attempts to...

CVE-2026-54203

The CVE describes a memory leak in Tobit Laboratories AG TeamDavid’s Webbox. The vulnerability is triggered by accessing the endpoint /.well-known/mta-sts, allowing an unauthenticated attacker to repeatedly request the URL and potentially read sensitive information (including user passwords). It ...

EUVD-2026-54435

Memory Leak to an Unauthorized Actor vulnerability in Tobit Laboratories AG TeamDavid's Webbox allows reading of sensitive information. When accessing the URL “/.well-known/mta-sts.”, the application responds with memory. By repeatedly requesting this endpoint, an attacker can access sensitive...

EUVD-2026-54221

Contiki-NG's LwM2M TLV parser lwm2mtlvread in os/services/lwm2m/lwm2m-tlv.c ignores its caller-supplied buffer length argument and reads up to six bytes from the input buffer with no bounds check. The caller in lwm2m-engine.c iterates while there is at least one byte remaining, so a crafted CoAP...

CVE-2026-70558

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new Filepath and file.transferTodest with no path validation. The route is marked @SaIgnore and /download/ is excluded from the Sa-Token interceptor, so the only guard is a header equality che...

CVE-2026-48054

OpenZeppelin Contracts Wizardis a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScript...

CVE-2026-48075 OpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the add-to-tunnel endpoint creates a new appointment row in any client tunnel without any caller authentication. A request that supplies any valid tunnelId and any...

Statamic: Unsafe method invocation via Antlers template resolution allows data destruction

Impact Manipulating user-supplied input incorporated into Antlers templates could result in the loss of content and assets. Exploitation requires a site to have templates that pass untrusted input into affected areas. It does not require authentication. Patches This has been fixed in 5.74.1 and...

Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Cybersecurity researchers have disclosed details of a "factory-shipped backdoor" implanted in at least 20 Chinese router models from Zbtlink. According to a new report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink that span more than 2 years. The...

Langflow < 1.3.0 - Remote Code Execution via validate_code() exec()

Langflow contains a remote code execution caused by inclusion of functionality from untrusted control sphere in the execglobals parameter at the validate endpoint, letting remote attackers execute arbitrary code as root, exploit requires no authentication. id: CVE-2026-0770 info: name: Langflow...

CVE-2026-17556

A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to delete arbitrary files and directories on the instance, including the entire user storage directory containing Git LFS objects, release assets, attachments, and avatars. The...

CVE-2026-71289

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. "$IONMGRPORT:-8089:8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the C...

CVE-2026-71265

Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages hardware/MochadTCP.cpp copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches DS10A/KR10A/MS10A devic...

EUVD-2026-53374

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. "$IONMGRPORT:-8089:8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the C...

CVE-2026-71289

The CVE affects NASA-AMMOS ANMS and JHUAPL-DTNMA/dtnma-tools. The default docker-compose setup exposes the amp-manager REST API on the host network (port 8089) with NET_ADMIN/NET_RAW/SYS_NICE and bypasses the CAM gateway, placing the REST server (CivetWeb, nm_rest.c) in a state where enable_auth_...

CVE-2026-71265 Domoticz MochadTCP Stack Buffer Overflow via MOCHAD_RFSEC strcpy()

Domoticz's MochadTCP::MatchLine handler for MOCHADRFSEC messages hardware/MochadTCP.cpp copies network-received data from the up-to-1028-byte mmochadbuffer into a fixed 50-byte stack buffer tempRFSECbuf using strcpy with no length check, across three separate code branches DS10A/KR10A/MS10A devic...

EUVD-2026-53345

ESPHome through 2026.7.0-dev discloses plaintext passwords via its webserver component. In WebServer::textjson esphome/components/webserver/webserver.cpp, a text entity configured with mode: password TEXTMODEPASSWORD has its JSON "state" field correctly masked as "", but the same serialization pa...