CVE-2026-24347: Improper Input Validation

Improper input validation in Admin UI of EZCast Pro II version 1.17478.146 allows attackers to manipulate files in the /tmp directory...

CVE-2026-24431 Tenda W30E V2 Web UI Reveals Passwords in Cleartext

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.195037 display stored user account passwords in plaintext within the administrative web interface. Any user with access to the affected management pages can directly view credentials...

MAL-2026-508 Malicious code in cartos-dds-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f496b09128d69f16784f2b9c7ac2d7f29982e802db47de225654f902cd2db4 The package cartos-dds-ui was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in cartos-dds-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1f496b09128d69f16784f2b9c7ac2d7f29982e802db47de225654f902cd2db4 The package cartos-dds-ui was found to contain malicious code. Source: ossf-package-analysis...

Exploit for CVE-2026-24061

CVE-2026-24061 Vulnerability Detection and Exploitation Tool...

Malicious Package

Overview ansi-universal-ui is a malicious package. This package contains malicious code, and it has been removed from the official package manager. The package sets up a standalone Python runtime and downloads an obfuscated payload from an Appwrite storage bucket that, upon execution, performs an...

CVE-2026-0782

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific fla...

CVE-2025-3839 Epiphany: insecure external protocol invocation in epiphany

A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...

"iRMC S5/S6" implemented in PRIMERGY vulnerable to incorrect authorization

Overview Remote Management Controller "iRMC S5/S6" implemented in PRIMERGY provided by Fsas Technologies Inc. contains the following vulnerability. Incorrect authorization CWE-863 - CVE-2025-65002 Fsas Technologies Inc. reported this vulnerability to JPCERT/CC to notify users of its solution...

GO-2026-4319 Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel

Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

MAL-2026-483 Malicious code in public-site-cms-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ab3fee105c88cb2417b79efd376d25e9f23afaaef354d5f154635820c702079 The package public-site-cms-ui was found to contain malicious code...

EUVD-2026-4527

Malicious code in integromat-ui npm...

MAL-2026-482 Malicious code in public-site-boostmoney-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7643372e3a22915c9385625b458ae16e2bb250b4b55e281371dc61644125e00 The package public-site-boostmoney-ui was found to contain malicious code...

MAL-2026-479 Malicious code in integromat-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7de4e86762c4fcb7682615925818028501cfb55cdd9fdeaf238f2e186b1f121e The package integromat-ui was found to contain malicious code...

Malicious code in public-site-boostmoney-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7643372e3a22915c9385625b458ae16e2bb250b4b55e281371dc61644125e00 The package public-site-boostmoney-ui was found to contain malicious code...

CVE-2026-0790: Direct Request

ALGO 8180 IP Audio Alerter Web UI Direct Request Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required to exploit this vulnerability. The...

CVE-2025-3839: Product UI does not Warn User of Unsafe Actions

A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused to exploit vulnerabilities within those handlers, making them appear remotely exploitable. The browser fails to properly warn or gate this...

CVE-2026-0789: Exposure of Sensitive Information to an Unauthorized Actor

ALGO 8180 IP Audio Alerter Web UI Inclusion of Authentication Cookie in Response Body Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is not required ...

CVE-2026-0795: Improper Neutralization of Special Elements used in an OS Command

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific fla...

CVE-2026-0780: Improper Neutralization of Special Elements used in an OS Command

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability. The specific fla...