CVE-2026-29513

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field. Attackers can inject malicious scripts through the System Status interface that...

CVE-2026-29510

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execut...

CVE-2025-62404

creationtimestamp| type| source ---|---|--- 2026-03-16 17:00:29+00:00| seen| https://infosec.place/objects/3235557a-973e-4707-a5a1-6216a897e9f4...

CVE-2026-29510 Hereta ETH-IMC408M Stored XSS via Device Name

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execut...

CVE-2026-29510

CVE-2026-29510 affects Hereta ETH-IMC408M firmware 1.0.15 and earlier. The vulnerability is a stored XSS in the Device Name field via the System Status interface, where unsanitized input can be injected and executed in users’ browsers viewing the status page. Root cause: input not properly saniti...

CVE-2026-29510 Hereta ETH-IMC408M Stored XSS via Device Name

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can inject malicious scripts through the System Status interface that execut...

CVE-2026-29513 Hereta ETH-IMC408M Stored XSS via Device Location

Hereta ETH-IMC408M firmware version 1.0.15 and prior contain a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Location field. Attackers can inject malicious scripts through the System Status interface that...

CVE-2026-29513

CVE-2026-29513 describes a stored XSS in Hereta ETH-IMC408M firmware ≤1.0.15. An authenticated attacker can inject JavaScript through the Device Location field via the System Status interface, with scripts executing in browsers of users viewing the status page. The CVSS 4.0 metrics indicate Netwo...

CVE-2026-1296

creationtimestamp| type| source ---|---|--- 2026-03-16 16:03:52+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-1296.yaml 2026-03-17 21:03:03+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mhbuolm47v2q...

CVE-2025-10685

creationtimestamp| type| source ---|---|--- 2026-03-16 14:57:11+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116239435734829861...

CERTFR-2026-ACT-011

creationtimestamp| type| source ---|---|--- 2026-03-16 13:21:17+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116239058462914309...

CVE-2026-4227

creationtimestamp| type| source ---|---|--- 2026-03-16 12:01:05+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116238743317716735 2026-03-21 03:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhk4bi22lq2a...

CVE-2025-15587

creationtimestamp| type| source ---|---|--- 2026-03-16 10:55:00+00:00| seen| https://cert.pl/en/posts/2026/03/CVE-2025-11500/ 2026-03-16 12:28:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116238849930743234...

CVE-2025-68261

creationtimestamp| type| source ---|---|--- 2026-03-16 08:05:20+00:00| seen| https://gist.github.com/joxd11222/1058f2b3d98f53fdb469fe874745a6ee 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-04-02 17:00:00+00:00| seen|...

CVE-2026-4212

creationtimestamp| type| source ---|---|--- 2026-03-16 04:30:27+00:00| seen| https://infosec.exchange/users/offseq/statuses/116236971339860975 2026-03-19 15:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhgdl3ozfv2u...

CVE-2026-4206

creationtimestamp| type| source ---|---|--- 2026-03-16 03:00:33+00:00| seen| https://infosec.exchange/users/offseq/statuses/116236617480442762...

CVE-2026-4201

creationtimestamp| type| source ---|---|--- 2026-03-16 01:30:42+00:00| seen| https://infosec.exchange/users/offseq/statuses/116236263599697730 2026-09-18 22:00:28+00:00| seen| https://bsky.app/profile/getpacketai.bsky.social/post/3mvt65negfe2u...

SUSE CVE-2010-4326

Multiple buffer overflows in gwwww1.dll in GroupWise Internet Agent GWIA in Novell GroupWise before 8.02HP allow remote attackers to execute arbitrary code via variables in a VCALENDAR message, as demonstrated by a long 1 REQUEST-STATUS, 2 TZNAME, 3 COMMENT, or 4 RRULE variable in this message...

PT-2026-25781

Name of the Vulnerable Software and Affected Versions Hereta ETH-IMC408M firmware versions prior to 1.0.15 Description The software contains a stored cross-site scripting issue that allows authenticated attackers to inject arbitrary JavaScript by manipulating the Device Name field. Attackers can...

PT-2026-25831

A security flaw has been discovered in Tiandy Easy7 Integrated Management Platform 7.17.0. The affected element is an unknown function of the file /rest/devStatus/queryResources of the component Endpoint. Performing a manipulation of the argument areaId results in sql injection. The attack can be...