FreeBSD : MySQL Connectors -- Multiple vulnerabilities (24aad1ab-d452-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 24aad1ab-d452-11f1-bae2-3497f65b111b advisory. Oracle reports: The October 2026 Critical Patch Update contains 98 new security patches for...

FreeBSD : MySQL 9.7 -- Multiple vulnerabilities (24aa87c0-d452-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 24aa87c0-d452-11f1-bae2-3497f65b111b advisory. Oracle reports: The October 2026 Critical Patch Update contains 98 new security patches for...

FreeBSD : MySQL 26.7 -- Multiple vulnerabilities, no fix available (24aaad94-d452-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 24aaad94-d452-11f1-bae2-3497f65b111b advisory. Oracle reports: The October 2026 Critical Patch Update contains 98 new security patches for...

MySQL 26.7 -- Multiple vulnerabilities, no fix available

Oracle reports: The October 2026 Critical Patch Update contains 98 new security patches for Oracle MySQL, 29 of which may be remotely exploitable without authentication. MySQL 26.7 is an Innovation release. It reached its end of life on 2026-10-20, when MySQL 26.10 was released, and Oracle ships ...

CVE-2026-66684

Unauthenticated Sensitive Data Exposure in Export Import Menus = 1.9.2 versions...

CVE-2026-70637 LightFTP 2.4 Data Race Condition via ABOR Command in ftpserv.c

LightFTP through 2.4 contains multiple data race vulnerabilities in ftpserv.c that allow anonymous attackers to cause undefined behavior by issuing LIST followed by ABOR commands without authentication. The control thread closes datasocket and filefd descriptors while worker threads concurrently...

CVE-2026-60009

In Eclipse Theia up to 1.73.1, the backend @theia/filesystem binds POST /file-upload in every filesystem-enabled deployment. The handler uses an attacker-supplied absolute path from the multipart uri field and calls fs.move(tmp, target, { overwrite: true }) with no workspace confinement and no au...

SUSE CVE-2026-34742

The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol MCP Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or...

OpenSCADA - Panel Detection

OpenSCADA is an open-source SCADA Supervisory Control and Data Acquisition system. Exposed instances may provide access to industrial control interfaces and operational technology OT data without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSCADA is an open-source SCADA...

Brother Printer Panel - Detect

Brother printer web interface and management panel was detected. This template identifies exposed Brother printer panels that may be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Brother printer web interface and management panel was detected.""" from kittysploit...

DATAGERRY - Improper Access Control Detection

The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information. !/usr/bin/env python3 -- coding: utf-8 --...

DEOS OPEN 500EMS Controller - Admin Exposure Detection

The DEOS OPEN 500EMS controller exposes administrative functions without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """The DEOS OPEN 500EMS controller exposes administrative functions without authentication.""" from kittysploit import from lib.protocols.http.httpclient import...

CODESYS WebVisu - Panel Detection

CODESYS WebVisu is the web-based HMI Human-Machine Interface component of the CODESYS industrial automation runtime. It provides browser-based access to PLC visualizations and industrial control interfaces. Exposed instances may reveal real-time process data and control functions without...

Molgenis Panel - Exposure Detection

Molgenis emx2 data platform is a software that provides a web-based interface for managing and analyzing data. It might contain sensitive information without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Molgenis emx2 data platform is a software that provides a web-based interface...

Sharp Multifunction Printers - Local File Inclusion Detection

It was observed that Sharp printers are vulnerable to a local file inclusion without authentication. Any attacker can read any file located in the printer. !/usr/bin/env python3 -- coding: utf-8 -- """It was observed that Sharp printers are vulnerable to a local file inclusion without...

CVE-2026-17612

Honeywell S35 Series 3M/5M/8M/PinHole Cameras, all versions prior to and including version HC5.26.1.14.20260207 contains an audit log disclosure Vulnerability that could allow an attacker to access audit logs without authentication, potentially resulting in the disclosure of sensitive information...

CVE-2026-35148

HCL DFXServer is affected by a Missing Access Control vulnerability. This vulnerability states that certain endpoints are accessible without any form of authentication in another browser. This allows any network user to invoke these APIs and interact with the application without verification of...

PT-2026-60587

EQ-3 Eqiva CC-RT-BLE Bluetooth Smart Radiator Thermostat Firmware up to the latest version 1.46 was discovered to allow unsecured bluetooth connections. This vulnerability allows attackers to gain full access to the device without authentication...

PT-2026-60454

Name of the Vulnerable Software and Affected Versions HCL DFXServer affected versions not specified Description Missing access control allows network users to invoke specific API endpoints and interact with the application without authentication or authorization verification. This occurs because...

CVE-2026-13230 Information Disclosure Vulnerability in Local Discovery Response in TP-Link Kasa EC70 and EC71

An information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related da...