EUVD-2026-109575

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpegturbo::decodejpegrgb of the file crates/multimodal/src/jpegturbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiate...

CVE-2026-116095

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpegturbo::decodejpegrgb of the file crates/multimodal/src/jpegturbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiate...

CVE-2026-116095 smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpegturbo::decodejpegrgb of the file crates/multimodal/src/jpegturbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiate...

CVE-2026-116095

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpegturbo::decodejpegrgb of the file crates/multimodal/src/jpegturbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiate...

CVE-2026-116095

A vulnerability exists in smg-project smg versions 1.7.0, 1.8.0, 1.9.0, 1.10.0, and 1.10.1 within the llm-multimodal component. The root cause is located in the jpeg_turbo::decode_jpeg_rgb function (file: crates/multimodal/src/jpeg_turbo.rs), where manipulation can lead to uncontrolled memory all...

CVE-2026-116095 smg-project smg llm-multimodal jpeg_turbo.rs decode_jpeg_rgb memory allocation

A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpegturbo::decodejpegrgb of the file crates/multimodal/src/jpegturbo.rs of the component llm-multimodal. The manipulation leads to uncontrolled memory allocation. The attack can be initiate...

PT-2026-123121

Name of the Vulnerable Software and Affected Versions smg-project smg versions 1.7.0 through 1.10.1 Description A remote attack can trigger uncontrolled memory allocation within the llm-multimodal component. The issue resides in the jpeg turbo::decode jpeg rgb function located in the...

SMG Software Information Portal Shell Upload / Command Injection

SMG Software Information Portal versions prior to 13.06.2025 contain an unrestricted dangerous-file upload and OS command injection vulnerability...

Exploit for CVE-2025-5243

CVE-2025-5243 — SMG Software Information Portal Arbitrary File...

@smg-automotive/auth (>=6.8.0-auth0-update-access-token-endpoint.1, <=9.3.5) potentially affected by CVE-2026-107369 via @auth0/nextjs-auth0 (>=4.9.0, <=4.25.0)

@auth0/nextjs-auth0 NPM version =4.9.0, =6.8.0-auth0-update-access-token-endpoint.1, =9.3.5 Source cves: CVE-2026-107369 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-20936946...

Synway SMG Gateway down.php - Arbitrary File Read Detection

There is an arbitrary file reading vulnerability in the down.php file of Synway SMG gateway management software, through which an attacker can download any file from the server. !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in the down.""" import re...

Synway SMG Gateway 9-2radius.php - Remote Command Execution Detection

Synway SMG Gateway Management Software contains a remote command execution vulnerability in 9-2radius.php, where the radiusaddress parameter is passed to a system call without sanitization. This allows unauthenticated attackers to execute arbitrary commands on the server. !/usr/bin/env python3 --...

CVE-2025-71284 Synway SMG Gateway Management Software OS Command Injection via radius_address

Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiusaddress POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can...

CVE-2025-71284

Synway SMG Gateway Management Software is affected by an OS command injection in the RADIUS configuration endpoint /en/9-2radius.php. The radius_address POST parameter (and related fields) is split and interpolated directly into a sed command without sanitization, enabling an unauthenticated remo...

Synway SMG Gateway Management Software: Operating System Command Injection Vulnerability

Synway SMG Gateway Management Software is a gateway management software developed by Synway Corporation. This software has a vulnerability related to operating system command injection. The vulnerability stems from the RADIUS configuration endpoint/en/9-2radius.php, where the radiusaddress POST...

CVE-2025-71284: Improper Neutralization of Special Elements used in an OS Command

Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where the radiusaddress POST parameter is split and interpolated directly into a sed command without sanitization. An unauthenticated remote attacker can...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: OSV:GHSA-XQ8M-7C5P-C2R6...

@smg-automotive/auth (>=8.2.3, <=9.0.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.0)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.1 Source cves: CVE-2026-40155 Source advisory: GHSA-XQ8M-7C5P-C2R6...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: SNYK:JS-AUTH0NEXTJSAUTH0-16109571...

@smg-automotive/auth (>=8.2.3, <=9.0.2-support-next-16.2.1) potentially affected by CVE-2026-40155 via @auth0/nextjs-auth0 (>=4.12.1, <=4.17.1)

@auth0/nextjs-auth0 NPM version =4.12.1, =8.2.3, =9.0.2-support-next-16.2.1 Source cves: CVE-2026-40155 Source advisory: MEND:CVE-2026-40155...