CVE-2026-40461 Anviz Products Missing Authentication for Critical Function

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings e.g., enabling SSH, allowing unauthorized state changes that can facilitate later compromise...

CVE-2026-40461

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings e.g., enabling SSH, allowing unauthorized state changes that can facilitate later compromise...

CVE-2026-40461

CVE-2026-40461 affects Anviz CX2 Lite and CX7. The flaw allows unauthenticated POST requests to modify debug settings (e.g., enabling SSH), causing unauthorized state changes that can facilitate later compromise. According to the provided documents, affected components are the devices’ debug/admi...

CVE-2026-31927

CVE-2026-31927 concerns the Anviz CX7 Firmware, where an authenticated CSV upload vulnerability enables path traversal to overwrite arbitrary files (for example, /etc/shadow). This can lead to unauthorized SSH access when combined with debug‑setting changes. The available connected sources confir...

CVE-2026-6439

The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozenconf function. The 'lang' POST parameter is stored directly via updateoption without any...

CVE-2026-6439 VideoZen <= 1.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'VideoZen available subtitles languages' Field

The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozenconf function. The 'lang' POST parameter is stored directly via updateoption without any...

PT-2026-33496

Name of the Vulnerable Software and Affected Versions Anviz CX2 Lite affected versions not specified Anviz CX7 affected versions not specified Description Anviz CX2 Lite and CX7 are susceptible to unauthenticated POST requests that modify debug settings, such as enabling SSH. This allows...

Anviz CX2 Lite 安全漏洞

The Anviz CX2 Lite is an intelligent terminal device from the American company Anviz, featuring integrated face recognition and access control functions. The Anviz CX2 Lite has a security vulnerability; this vulnerability stems from POST requests that lack authentication, allowing for modificatio...

wger 安全漏洞

wger is an open-source FLOSS fitness/exercise, nutrition, and weight tracking application developed using Django by the wger Project. Versions of wger 2.5 and earlier contained security vulnerabilities. These vulnerabilities stemmed from the fact that the GymConfigUpdateView declared a...

PT-2026-33486

Anviz CX7 Firmware is vulnerable to an authenticated CSV upload which allows path traversal to overwrite arbitrary files e.g., /etc/shadow, enabling unauthorized SSH access when combined with debug‑setting changes...

PT-2026-33430

Name of the Vulnerable Software and Affected Versions VideoZen versions prior to 1.0.2 Description The VideoZen plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping in the videozen conf function. The lang POST parameter is...

Unity Linux 20.1050e / 20.1070e Security Update: kernel (UTSA-2026-007499)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-007499 advisory. In the Linux kernel, the following vulnerability has been resolved: ethtool: Fix uninitialized number of lanes It is not possible to set the number of lanes when...

[SECURITY] Fedora 44 Update: sddm-kcm-6.6.4-1.fc44

This is a System Settings configuration module for configuring the SDDM Display Manager...

[SECURITY] Fedora 44 Update: plasma-thunderbolt-6.6.4-1.fc44

Plasma Sytem Settings module and a KDED module to handle authorization of Thunderbolt devices connected to the computer. There's also a shared library libkbolt that implements common interface between the modules and the system-wide bolt daemon, which does the actual hard work of talking to the...

[SECURITY] Fedora 44 Update: plasma-systemsettings-6.6.4-1.fc44

KDE System Settings application...

[SECURITY] Fedora 44 Update: plymouth-kcm-6.6.4-1.fc44

This is a System Settings configuration module for configuring the plymouth splash screen...

[SECURITY] Fedora 44 Update: plasma-login-manager-6.6.4-1.fc44

Plasma Login provides a display manager for KDE Plasma and with an new frontend providing a greeter, wallpaper plugin integration and a System Settings module KCM...

[SECURITY] Fedora 44 Update: kf6-kconfigwidgets-6.25.0-1.fc44

KConfigWidgets provides easy-to-use classes to create configuration dialogs, as well as a set of widgets which uses KConfig to store their settings...

[SECURITY] Fedora 44 Update: kde-gtk-config-6.6.4-1.fc44

This is a System Settings configuration module for configuring the appearance of GTK apps in KDE...

BIT-AUTHENTIK-2022-46145 authentik vulnerable to unauthorized user creation and potential account takeover

authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account takeover. With the default flows, unauthenticated users can create new accounts in authentik. If a flow exists that allows for email-verified...