CVE-2020-13159

CVE-2020-13159 - Artica Proxy before 4.30.000000 Community Edition allows Multiple OS command injection. Product Description: Artica Tech offers a powerful but simple-to-use solution, usually the preserve of Large and Multinational companies. With a starting price of just 99€ and more than 62 000...

CVE-2026-108578 Neterbit NW-431F Embedded Web Server sms.json information disclosure

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2026-108578

A vulnerability exists in the Embedded Web Server component of Neterbit NW-431F 20250715 . Specifically, an unknown function within the /sms.json file allows for information disclosure . This vulnerability can be triggered via a remote attack . No remediation details or specific exploit informati...

EUVD-2026-96927

A vulnerability was identified in Neterbit NW-431F 20250715. Impacted is an unknown function of the file /sms.json of the component Embedded Web Server. Such manipulation leads to information disclosure. The attack may be launched remotely. The vendor was contacted early about this disclosure but...

CVE-2025-53770

CVE-2025-53770 SharePoint Description The deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an attacker to execute code remotely and compromise the system. Microsoft is aware of active exploitation and is preparing a comprehensive update. Ensure that mitigations...

staystaystay

staystaystay staystaystay es un exploit de prueba de concepto para CVE-2021-1585, un problema de RCE de intermediario o punto final malicioso que afecta a Cisco ASA Device Manager ASDM. El problema fue descubierto originalmente por Malcolm Lashley y divulgado en el verano de 2021. Sin embargo, en...

EUVD-2026-96926

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...

CVE-2026-108577

A vulnerability exists in Konstanty Bialkowski libmodplug versions up to 0.8.9.1 . The flaw is located within the abc_add_gchord function in the src/load_abc.cpp file of the ABC Music Format Parser component. This issue leads to resource consumption and can be initiated remotely. No specific reme...

CVE-2026-108577 Konstanty Bialkowski libmodplug ABC Music Format load_abc.cpp abc_add_gchord resource consumption

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...

CVE-2026-108577

A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abcaddgchord of the file src/loadabc.cpp of the component ABC Music Format Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The vendor was...

CVE-2026-108748 Quarkus LangChain4j 1.9.0 through 1.14.1 Memory Exhaustion via /_chat/routes WebSocket

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108748

Quarkus LangChain4j versions 1.9.0 through 1.14.1 are vulnerable to a memory exhaustion issue within the chat-scopes WebSocket /_chat/routes endpoint. The root cause is a missing release of memory where unauthenticated remote clients can send repeated CONNECT frames while reusing a single chatId ...

EUVD-2026-96913

Quarkus LangChain4j 1.9.0 through 1.14.1 contains a missing release of memory vulnerability in the chat-scopes WebSocket /chat/routes endpoint that allows unauthenticated remote clients to exhaust server memory. Attackers can send repeated CONNECT frames reusing one chatId, leaving orphaned scope...

CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

CVE-2026-108736 Speedtest Tracker through 1.15.0 IP Allowlist Bypass via X-Forwarded-For Spoofing

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWEDIPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowliste...

EUVD-2026-96990

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

CVE-2026-108716

The mcp-remote library, versions 0.8.0 through 0.14.3 , is vulnerable to a cleartext transmission flaw within the authorizeWithDeviceCode function. The root cause is the failure to enforce HTTPS endpoints when handling device authorization and token endpoints. If these endpoints are non-loopback ...

CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

CVE-2026-108716 mcp-remote 0.8.0 through 0.14.3 Cleartext Credential Transmission via --device-code OAuth Grant

mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attacker...

CVE-2026-108575

A flaw was found in LiteLLM. A remote attacker can exploit improper authorization within the secret resolution mechanism by manipulating the apikey parameter. This vulnerability allows an attacker to bypass authorization controls and potentially access protected secrets or resources...