EUVD-2026-64843

RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/ endpoint permits selected internal databases to be exported without requiring authentication. While...

AppEngine vulnerability affects SICK ICR890-4 and SICK InspectorP6xx devices

Multiple internal virtual filesystem paths are unintentionally accessible remotely in the SICK ICR890-4 and SICK InspectorP6xx devices. If exploited, this vulnerability could potentially allow an unauthenticated attacker to compromise the availability, integrity, and confidentiality of the device...

CVE-2026-78369

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. Although this endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attac...

CVE-2026-78369 Missing Authentication Allows Unauthorized Creation of Crypto Groups in RansomLook

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

tugtainer-1.30.2-CVE-2026-55494-and-CVE-2026-62308-to-RCE

Tugtainer v1.30.2 RCE L'RCE viene ottenuta sfruttando 2 vulnerabilità CVE-2026-55494 CVE-2026-62308 In breve, una vulnerabilità SSRF viene sfruttata per chiamare un servizio non autenticato nella rete interna per creare un docker che condivide lo stesso pid con tugtainer, rendendo così accessibil...

CVE-2026-28151

Unauthenticated Local File Inclusion in Tonda 2.6 versions...

EUVD-2026-64794

Unauthenticated Privilege Escalation in Digits = 9.2 versions...

CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

EUVD-2026-64830

Unauthenticated Cross Site Scripting XSS in 12 Step Meeting List = 3.19.16 versions...

wordpress-skelersecurity-core-security-CVE-2026-63030

Plugin di Sicurezza Core SkelerSecurity Una mitigazione temporanea e mirata per l'accesso non autenticato all'endpoint REST Batch API di WordPress Core. Panoramica Plugin di Sicurezza Core SkelerSecurity richiede l'autenticazione prima che WordPress elabori le richieste all'endpoint Core REST Bat...

CVE-2026-6017

KAON PG5298A and PG5298B routers contain a firmware vulnerability classified as Missing Authentication for Critical Function . An unauthenticated user on an adjacent network can query a specific endpoint to disclose sensitive information, including the password to the administrative portal , yiel...

EUVD-2026-64827

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2026-6017 Missing Authentication for Critical Function in KAON PG5298

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CYBERDUDEBIVASH-MONGODB-DETECTOR-v2026

CYBERDUDEBIVASH MONGODB DETECTOR TOOL v2026.1 Rileva istanze MongoDB esposte e rischi CVE-2025-14847 "MongoBleed" — Scanner Python Zero-Trust. Nel 2026, i database MongoDB malconfigurati rimangono una delle principali cause di violazioni dei dati e attacchi ransomware. Questo strumento aiuta i...

CVE-2026-63563

CVE-2026-63563 - Modifica non autenticata della rubrica su multifunzione Sharp MX/BP Avviso del fornitore: Sharp Product Security Advisory 2026-004 pubblicato il 31 luglio 2026 Sintesi I multifunzione delle serie Sharp MX/BP espongono la rubrica tramite l'interfaccia web del dispositivo senza...

PoC-for-CVE-2025-9074

CVE-2025-9074 - PoC für nicht authentifizierten Zugriff auf die Docker-API 📌 Übersicht Dieses Repository stellt einen Proof-of-Concept-Exploit PoC für CVE-2025-9074 bereit, der die nicht authentifizierte Offenlegung der Docker-Engine-API auf TCP-Port 2375 betrifft. Ein Angreifer, der auf diese...

CVE-2026-78255

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...

CVE-2026-78306 DJI Drone Bluetooth Interface Unauthenticated DUML Command Execution

DJI drones expose an unauthenticated DUML command interface over Bluetooth that allows an attacker within Bluetooth range to modify Wi-Fi configuration parameters, including the SSID, PSK, MAC address, regulatory country code, and wireless channel. An attacker can overwrite the Wi-Fi PSK with a...

CVE-2026-78306

DJI drones expose an unauthenticated DUML command interface over Bluetooth , allowing an attacker within Bluetooth range to modify Wi-Fi configuration parameters (SSID, PSK, MAC, regulatory country code, channel). By overwriting the Wi-Fi PSK with a known value, an attacker can connect to the dro...

EUVD-2026-64746

The HTTP media server running on DJI drones serves stored photos and videos through the /v2 endpoint without authenticating the requesting client. Filenames follow a predictable pattern, allowing an attacker who joins the drone's internal network to enumerate valid filenames and exfiltrate stored...