CVE-2026-66724

MWDB Core versions 2.0.0 to 2.18.x contain a missing authorization vulnerability in deprecated config and blob upload endpoints. The undocumented POST method bypasses capability checks that apply to the documented PUT method, allowing any authenticated user without adding_configs or adding_blobs ...

Alien Technology ALR-9900 RFID-reader backdoor

There are undocumented remote access methods with undocumented default accounts...