33194 matches found
EUVD-2026-53020
A vulnerability was determined in lavkush-maurya Student-Registration-System 1.0. The affected element is an unknown function of the file /student/changepass.php. Executing a manipulation of the argument oldpass can lead to sql injection. It is possible to launch the attack remotely. The exploit...
CVE-2026-18103
A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...
UBUNTU-CVE-2026-18103
A flaw was found in dhcp-server. A remote attacker with network access to the OMAPI Open Management Application Programming Interface port, especially if not secured with TSIG Transaction Signature key authentication, could send a specially crafted lease creation request. This request, containing...
Malicious code in sextant-cli-linux-amd64 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aab426dad8f1e5722f2836debe2f93730df98b7c109865426208edb687955b30 sextant-cli-linux-amd64 ships a Linux amd64 Go binary that, on execution, connects to a hardcoded WebRTC signaling relay at wss://relay.sextant.top a...
CVE-2025-63823
My Safetipin Android Application 5.2.1 contains Hardcoded credentials in the authentication module, which allows remote attackers to bypass authentication and gain unauthorized access to user accounts via predictable OTP values...
openjdk: Enhance JPEG handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. ASAN reports a heap integrity violation...
CVE-2026-18818 Ehco1996 django-sspanel Support Ticket views.py TicketDetailView authorization
A weakness has been identified in Ehco1996 django-sspanel up to 2023.12.26. This affects the function TicketDetailView of the file apps/sspanel/views.py of the component Support Ticket Handler. Executing a manipulation can lead to authorization bypass. The attack can be executed remotely. The...
CVE-2026-18810
A security vulnerability has been detected in H3C NX15 V100R017. Impacted is an unknown function of the file /api/wizard/networkSetup. Such manipulation leads to missing authentication. The attack may be performed from remote. The vendor was contacted early about this disclosure...
EUVD-2026-52790
Multiple vulnerabilities in the REST API interface of HPE Networking SD-WAN Orchestrator could allow an unauthenticated remote attacker to bypass web authentication mechanisms and access system functions. Successful exploitation could allow an attacker to view and modify potentially sensitive...
openjdk: Enhance Jar handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files...
CVE-2026-18773
A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function checkslashaccess of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The attack can be launched remotely. The exploi...
EUVD-2026-52727
A vulnerability was detected in NousResearch hermes-agent up to 2026.6.5. Affected by this issue is the function checkslashaccess of the file gateway/run.py of the component Quick Command Handler. The manipulation results in incorrect authorization. The attack can be launched remotely. The exploi...
CVE-2026-18685
CVE-2026-18685 affects GL.iNet GL-MT3000 devices up to firmware 4.4.5, specifically the function set_upgrade in /cgi-bin/glc of the component modem.so. The issue enables remote command injection due to the underlying vulnerability; attack vector is network with no authentication and no user inter...
CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup
LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...
MAL-2026-11419 Malicious code in cognikit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 10004c754152c722c21eae7feef7b67211c78360f100931614f90f37533aafa0 The package is published under an 'AI toolkit' cover story README advertises 'CognitKit: Cognitive building blocks for intelligent AI systems' and a...
MAL-2026-11415 Malicious code in aichannel (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7e51fdc38d5678b9b9a96014b69db1062b6ecc71b8986a837b4e9ba8d03d7214 Package connects to a hardcoded C2 socket server SOCKETSERVERHOST/SOCKETSERVERPORT from cognikit.config and runs a typed-message session loop that...
CVE-2026-65313
A provisioning script used when installing HIPASE-250 formerly 250 SCALA engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VN...
CVE-2026-6890
This CVE-2026-6890 entry, as reflected by PT-2026-66670, concerns a default-credentials vulnerability in Advantech ECU-1251D. A remote attacker could gain unauthorised SSH access via the device’s default root account with no password, because credentials are not changed during configuration. The ...
EUVD-2026-51329
The RCU II+ and Multiload II+ are vulnerable to an unauthenticated service that exposes a debug interface granting full root-level access to the embedded system. This vulnerability stems from a network-accessible port running a Target Communications Framework TCF service that does not require any...