161170 matches found
CVE-2026-95273 dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch...
EUVD-2026-84370
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch...
CVE-2026-95273 dgtlmoon changedetection.io visual_selector_data flask_app.py static_content path traversal
A vulnerability was determined in dgtlmoon changedetection.io up to 0.60.7. This impacts the function staticcontent of the file changedetectionio/flaskapp.py of the component visualselectordata. Executing a manipulation of the argument filename can lead to path traversal. It is possible to launch...
New CVSS 10.0 VeloCloud Orchestrator Flaw Actively Exploited in Certificate-Based Setups
Attackers are exploiting a new flaw in on-premises VeloCloud Orchestrator VCO, the server that manages the Edge devices in a VeloCloud SD-WAN, Arista said on September 22. The flaw, tracked as CVE-2026-93952 , may allow a remote attacker with no login access to privilege internal functions and...
CVE-2026-95272 dgtlmoon changedetection.io Screenshot flask_app.py static_content path traversal
A vulnerability was found in dgtlmoon changedetection.io up to 0.60.7. This affects the function staticcontent of the file changedetectionio/flaskapp.py of the component Screenshot Handler. Performing a manipulation of the argument filename results in path traversal. It is possible to initiate th...
CVE-2026-95271 dgtlmoon changedetection.io Authentication Hook flask_app.py check_authentication improper authentication
A vulnerability has been found in dgtlmoon changedetection.io up to 0.60.7. The impacted element is the function checkauthentication of the file changedetectionio/flaskapp.py of the component Authentication Hook. Such manipulation leads to improper authentication. The attack may be performed from...
DEBIAN-CVE-2026-68956
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...
AZL-103425 CVE-2026-68956 affecting package erlang 26.2.5.21-6
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...
UBUNTU-CVE-2026-68956
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...
CVE-2026-68956 SSH daemon allocates unbounded idle session channels, bypassing max_channels
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node memory by repeatedly opening session channels that are never assigned a handler. The "session" clause of sshconnection:handlemsg/4 checks only...
EUVD-2026-84296
VeloCloud Orchestrator VCO on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by...
CVE-2026-93952
The VeloCloud Orchestrator (VCO) on-prem platform is vulnerable to an improper input validation flaw (CWE-20 ). A remote attacker without login access can exploit this to access privileged internal functions, potentially compromising the confidentiality, integrity, and availability of the orchest...
CVE-2026-94493
A missing authentication vulnerability in the WebSocket Service component of Gigatech PDV5701 version 1.0.31_240305_112640 affects the file /index.html. The flaw allows a remote attacker with no privileges to exploit the service, rated CVSS 4.0: 10.0 (Critical) with high impact across confidentia...
CVE-2026-94493 Gigatech PDV5701 WebSocket Service index.html missing authentication
A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...
EUVD-2026-84259
A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...
CVE-2026-94493 Gigatech PDV5701 WebSocket Service index.html missing authentication
A vulnerability was detected in Gigatech PDV5701 1.0.31240305112640. This issue affects some unknown processing of the file /index.html of the component WebSocket Service. The manipulation results in missing authentication. The attack can be launched remotely. The exploit is now public and may be...
EUVD-2026-84248
A vulnerability was identified in OctoPrint 1.0.0. Affected by this vulnerability is the function validate of the file src/octoprint/server/api/files.py of the component File Download API. Such manipulation of the argument filename leads to path traversal. The attack may be performed from remote...
CVE-2026-94491 Yonyou KSOA search_list.jsp sql injection
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...
EUVD-2026-84252
A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/searchlist.jsp. Executing a manipulation of the argument address can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and cou...