CVE-2026-85478 CareCam CM2507 Missing Authentication for Critical Function

A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface without requiring authentication. An attacker with physical access could interrupt the normal boot process and access functionality that permits inspection or...

ELFLoader

ELFLoader This is a ELF object in memory loader/runner. The goal is to create a single elf loader that can be used to run follow on capabilities across all x8664 and x86 nix operating systems. How it works The way this loader works is that it has all the code needed to build and load an ELF objec...

CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-93533

spatie Scotty (a Laravel package) is affected by an OS command injection in the Doctor Command Handler component, specifically in the DoctorCommand::checkSshConnectivity and DoctorCommand::checkRemoteTools functions within app/Commands/DoctorCommand.php. The vulnerability exists in versions up to...

EUVD-2026-83045

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-84400 CareCam CM2507 Missing Authentication for Critical Function

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of...

CVE-2026-84400 CareCam CM2507 Missing Authentication for Critical Function

CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An attacker on the same local network who satisfies certain device state conditions could make the service remotely accessible, increasing the risk of...

CVE-2026-88259 CareCam CM2507 Missing Authentication for Critical Function

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video...

CVE-2026-88259 CareCam CM2507 Missing Authentication for Critical Function

CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with network access to the affected device could retrieve live camera video...

CVE-2026-71851

A flaw was found in crypto-js. The CryptoJS.lib.WordArray.random function, used for generating cryptographic secrets, employs a weak pseudorandom number generator instead of a cryptographically secure source. This significantly reduces the randomness of generated values, such as those used for...

CVE-2026-84448

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

EUVD-2026-83015

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

CVE-2026-84448

libheif , a HEIF and AVIF file format decoder/encoder, contains a heap out-of-bounds read in its region writer API prior to version 1.23.2 . The function heif_region_item_add_region_inline_mask_data() in heif_regions.cc accepts a mask_data_len parameter without verifying it matches the byte count...

CVE-2026-84448 libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

CVE-2026-84448 libheif: Heap out-of-bounds read in libheif inline-mask region API (heif_region_item_add_region_inline_mask_data / heif_region_get_mask_image)

libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heifregionitemaddregioninlinemaskdata function in libheif/api/libheif/heifregions.cc accepts maskdatalen without verifying that it equals the byte count required by width and height. A later...

HTB-Reactor-Linux-Machine-Walkthrough

HTB: Reactor !CAUTION Spoiler warning. This is a full walkthrough including flags. If you want to solve the machine yourself, close this now and come back when you're stuck. Machine Info Field| Details ---|--- Name| Reactor OS| Ubuntu 24.04 LTS Noble Difficulty| Medium CVE| CVE-2025-55182 CVSS 10...

CVE-2026-93532 gedelumbung HospitalManagement Password Change password.php simpan improper authentication

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file...

EUVD-2026-83128

A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function application/modules/global/controllers/password.php::simpan/application/modules/global/controllers/profil.php::simpan of the file...