CVE-2026-36612

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 enables WPS 2.0 by default with a weak lockout policy 60-second lockout after 10 attempts...

Mercusys AC12G 配置错误漏洞

The Mercusys AC12G is a Gigabit wireless router produced by the Chinese company Mercusys. The Mercusys AC12G EU V1 AC12G EU V1 version has security vulnerabilities. These vulnerabilities stem from the default enablement of WPS 2.0 and a weak lock policy, which may lead to brute-force attacks...

CVE-2026-36616

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 contains hardcoded WiFi driver credentials including a RADIUS shared secret, WPS test key, and default PSK embedded in the production firmware binary...

CVE-2026-36612

Mercusys AC12G EU V1 with firmware AC12GEUV1200909 enables WPS 2.0 by default with a weak lockout policy 60-second lockout after 10 attempts...

CVE-2026-7313

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with...

CVE-2026-7313

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with...

CVE-2026-7312

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to...

The Manhattan Institute Helped Kill DEI. Now It’s Coming for Protests

The right-wing think tank is actively pushing “civil terrorism”—increasing penalties for minor crimes committed while people engage in constitutionally protected free speech...

The vulnerability of the setTo method in the ResourceTypes.cpp script of the Android operating system’s Framework component allows a hacker to disclose sensitive information that should be protected.

The vulnerability of the setTo method in the ResourceTypes.cpp script of the Android operating system’s Framework component is related to the execution of operations outside of the buffer in memory. Exploiting this vulnerability could allow an attacker to disclose sensitive information that is...

The vulnerability of the `updateProvidersWhenServiceRemoved` method in the `CredentialManagerService.java` class of the Android operating system framework component allows a hacker to disclose sensitive information that should be protected.

The vulnerability of the updateProvidersWhenServiceRemoved method in the CredentialManagerService.java class of the Android operating system’s framework is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to disclose sensitive information that is...

CVE-2026-7313: Insufficiently Protected Credentials

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 8.0.5700 to 13.3.7652 allows a remote authenticated attacker to obtain plain-text credentials used connect to Sitefinity Insight service. Successful exploitation requires active integration with...

CVE-2026-7312: Insufficiently Protected Credentials

CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity version from 14.0.7700 to 14.4.8152, and 15.0.8200 to 15.0.8234, and 15.1.8300 to 15.1.8335, 15.2.8400 to 15.2.8441, 15.3.8500 to 15.3.8531, and 15.4.8600 to 15.4.8630 allows a remote unauthenticated attacker to...

CVE-2026-28511

CVE-2026-28511 affects eLabFTW. Before version 5.4.2, an authenticated user performing a numeric reference/search could receive results that include resources the user is not authorized to view. The exposed data is limited to resource titles; attempts to access the underlying protected content re...

The vulnerability of the OpenShift AI platform, related to insufficient spatial partitioning, allows attackers to compromise the confidentiality and integrity of the protected information.

The vulnerability of the OpenShift AI platform for developing artificial intelligence models is related to insufficient spatial partitioning. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality and integrity of the protected information...

The vulnerability of the Real Estate Property Management System allows a perpetrator to gain unauthorized access to protected information and execute arbitrary codes.

The vulnerability of the Real Estate Property Management System is related to the failure to take measures to neutralize certain elements. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information and execute arbitrary codes...

The vulnerability of the FlinkSessionJob component in the automation tool for deploying, managing, and scaling a distributed data processing platform. This vulnerability allows attackers to gain unauthorized access to protected information.

The vulnerability of the FlinkSessionJob component in the automation tool for deploying, managing, and scaling a distributed data processing platform called Apache Flink Kubernetes Operator is related to the use of files and directories accessible to external parties. Exploiting this vulnerabilit...

The vulnerability of the moodle-mod_customcert plugin in the virtual learning environment Moodle, which allows a intruder to gain unauthorized access to protected information

The vulnerability of the moodle-modcustomcert plugin in the virtual learning environment Moodle relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow an intruder, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the learning platform IQ SCHOOL, related to deficiencies in the authentication process, allows unauthorized access to protected information.

The vulnerability of the learning platform IQ SCHOOL is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the PowerChute Serial Shutdown software for managing uninterruptible power sources is related to insufficient restrictions on authentication attempts. This allows a intruder to compromise the accessibility of protected information.

The vulnerability of the PowerChute Serial Shutdown software for managing uninterruptible power sources is related to insufficient restrictions on authentication attempts. Exploiting this vulnerability could allow an attacker, operating remotely, to compromise the accessibility of protected...

Linux Distros Unpatched Vulnerability : CVE-2026-47762

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - TinyMCE is an open source rich text editor. Prior to 5.11.1, 7.9.3, and 8.5.1, there is a stored XSS vulnerability via forged mce:protected comments. Allows...