CVE-2026-85585

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in its request-concurrency middleware (ControlConcurrency). The middleware retains mutex entries for every unique request path without any eviction mechanism . An unauthenticated remote attacker can send numerous unique...

CVE-2026-84428

A flaw was found in fastify. Due to incomplete case normalization of HTTP header names within a route's header schema, specifically within the JSON Schema Draft 7 dependencies keyword, an unauthenticated remote attacker can bypass intended conditional checks. This allows the attacker to send...

CVE-2026-84043

The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation requests, allowing unauthenticated attackers to mark orders as paid without a valid gateway signature...

EUVD-2026-70992

The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment...

CVE-2026-85147

SmartIT Desktop Manager developed by Lightstar contains a hard-coded credentials vulnerability. An unauthenticated remote attacker can extract a specific password from the source code and use it to retrieve the AES encryption key used for communication, resulting in a high confidentiality impact ...

CVE-2026-85146

SmartIT Desktop Manager by Lightstar contains a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code. This exposes the agent's SSH service account ...

EUVD-2026-70868

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code...

CVE-2026-85146 Lightstar｜SmartIT Desktop Manager - Use of Hard-coded Credentials

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code...

EUVD-2026-71443

Cross-site scripting XSS vulnerability in the /loginController/doLogin endpoint of the HubCore platform version 14.1.1 allows a remote unauthenticated attacker to inject arbitrary JavaScript into the application's response via the language POST parameter...

CVE-2026-75170

The HubCore platform (version 14.1.1) is vulnerable to a Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint. A remote unauthenticated attacker can inject arbitrary JavaScript into the application's response by exploiting the language POST parameter . Practical conse...

PT-2026-85699

CVE-2026-75170: Unauthenticated XSS in HubCore 14.1.1 via /loginController/doLogin language param. CVSS N/A, no patch yet. Attackers can inject arbitrary JS. Audit exposure and restrict access now. Details: https://t.co/2JPeD1RjLr CVE infosec XSS valtersit snippet infosec SysAdmin cybersecurity...

CVE-2026-85585: Uncontrolled Resource Consumption

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory an...

PT-2026-85557

Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max neighbors, ef construction, and ef search in collection-create requests. Unauthenticated attackers can supply arbitrarily large parameter values to exhaust server memory and cause denial of service during index compaction...

EUVD-2021-34874

Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight...

PT-2026-85384

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for communication...

PT-2026-85383

SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source code...

CVE-2021-44319

The Parrot AR.Drone 1 and AR.Drone 2 platforms are susceptible to a Denial of Service (DoS) vulnerability. The root cause is a susceptibility to Wi-Fi deauthentication attacks , which allows remote and unauthenticated attackers to forcibly disconnect the drone from its controller while in mid-fli...

PT-2026-86210

Parrot AR.Drone 1 and AR.Drone 2 are vulnerable to Denial of Service. The Parrot AR.Drone platform is vulnerable to Wi-Fi deauthentication attack, allowing remote and unauthenticated attackers to disconnect drone from controller during mid-flight...

CVE-2026-79390

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...

EUVD-2026-71741

Trueview TI8161 6.0.23.4 is vulnerable to information disclosure due to the transmission of MQTT communications in plaintext over TCP port 1883. An unauthenticated attacker with access to the same network segment can intercept MQTT traffic and obtain sensitive device information and operational...