CVE-2026-71922

Multiple DrayTek VigorSwitch models are affected by a pre-authentication null pointer dereference in the setget.cgi interface. The root cause is missing validation when the pass field is absent from a request, allowing a remote unauthenticated attacker to crash the service via a crafted request, ...

CVE-2026-71922 DrayTek VigorSwitch Multiple Models Pre-Authentication NULL Pointer Dereference via setget.cgi

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

EUVD-2026-64981

Multiple DrayTek VigorSwitch models contain a pre-authentication null pointer dereference vulnerability in the setget.cgi interface. The vulnerability is caused by missing validation when the pass field is absent. A remote attacker can trigger this vulnerability via a crafted request to crash the...

CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

EUVD-2026-64979

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

CVE-2026-71920

DrayTek VigorSwitch (multiple models) contains a null pointer dereference in the formlogout function caused by missing validation of the Cookie header before string handling. A remote attacker with valid administrative credentials on the web management interface can send a crafted request to cras...

CVE-2026-71920 DrayTek VigorSwitch Multiple Models NULL Pointer Dereference via formlogout

Multiple DrayTek VigorSwitch models contain a null pointer dereference vulnerability in the formlogout function. The vulnerability is caused by missing checks for an empty or absent Cookie header before string handling. A remote attacker can trigger this vulnerability via a crafted request to cra...

Cartero

Cartero URL http://section9labs.github.io/Cartero/ Description Um framework robusto de Phishing com uma interface CLI completa. O projeto nasceu da necessidade ao longo de anos de trabalhos com ferramentas que simplesmente não faziam o trabalho. Embora existam muitos projetos por aí, não...

CVE-2023-5412

CVE-2023-5412 Image horizontal reel scroll slideshow = 13.2 - Injeção SQL autenticada Subscriber+ via Shortcode Descrição: O plugin Image horizontal reel scroll slideshow para WordPress é vulnerável a Injeção SQL por meio do shortcode do plugin nas versões até, e inclusive, 13.2 devido ao escape...

chronomaly-webos

Chronomaly — CVE-2025-38352 su LG webOS Exploit del kernel per CVE-2025-38352 condizione di gara del timer CPU POSIX / use-after-free che ottiene root persistente su Smart TV LG webOS con kernel 5.4.268 su ARM64. Verificato su 4 modelli di TV in diverse versioni firmware. Divulgato responsabilmen...

Log4jPatcher

Log4jPatcher Una mitigazione basata su Java Agent per gli exploit JNDI di Log4j2. Questo agente impiega 2 patch: Disabilitazione di tutte le conversioni Lookup nelle versioni di Log4j supportate in org.apache.logging.log4j.core.pattern.MessagePatternConverter impostando noLookups su true nel...

CVE-2026-76070

CVE-2026-76070: Netis NC63 login.cgi में बेस64-डिकोडेड पासवर्ड के माध्यम से बिना प्रमाणीकरण प्री-ऑथ स्टैक बफर ओवरफ्लो, जो RCE की ओर ले जाता है शोधकर्ता: Özcan Ersan @ozcanpng प्रकटीकरण स्थिति CVE: CVE-2026-76070 विक्रेता: Netis Systems Co., Ltd. उत्पाद: Netis NC63 Wireless AC1200 Router परीक्षित...

CVE-2026-77679

A path traversal ZIP slip vulnerability exists in Epiphany when installing WebExtension packages from .xpi files. In src/webextension/ephy-web-extension-manager.c, the decompressxpithread function extracts XPI archives ZIP format to disk using libarchive. For each archive entry, the output path i...

Exploit for Command Injection in Apache Ranger

CVE-2026-28672 — Apache Ranger UnixUserGroupBuilder OS comma...

CVE-2026-13343

The UMP Stream responder library in lib/midi2/umpstreamresponder.c builds reply packets in a 16-byte struct midiump uint32t data4. The builders makeendpointinfo and makefunctionblockinfo populate only the first two words res.data0 and res.data1 and, before this fix, declared their result as an...

CVE-2026-13212

The Zephyr virtio driver does not validate the descriptor-chain head id that the virtio device writes into the used ring. In virtioisr drivers/virtio/virtiocommon.c, the device-written vq-used-ringidx.id is used directly as an index into vq-recvcbs and vq-desc, which are both allocated with exact...

EUVD-2026-64959

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

CVE-2026-66908 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

CVE-2026-66908 Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

Improper Authentication vulnerability in Apache Camel Platform HTTP Main component. This issue affects Apache Camel: from 4.8.0 before 4.22.0. The camel-main embedded HTTP server can protect its endpoints with JWT authentication, configured through authenticationEnabled together with the JWT...

CVE-2026-66908

Apache Camel Platform HTTP Main component (versions 4.8.0 through 4.21.x ) silently skipped validation of the iss and aud JWT claims when neither jwtIssuer nor jwtAudience was configured. The root cause is that JWTAuthenticationConfigurer.buildJwtOptions returned null, causing the Vert.x JWTAuth ...