CVE-2026-102370

The TP-Link Kasa EC70 v4 and EC71 v4 devices are vulnerable because the production debug interface is not logically disabled at the firmware or chip level, and the bootloader remains unlocked. While debug traces are physically severed during manufacturing, an attacker with physical access can res...

CVE-2026-104020

The Amazon Ion Python library (versions prior to 0.15.0 ) is vulnerable to a denial of service due to uncontrolled recursion in the Ion reader . A remote, unauthenticated actor can crash the application by providing a crafted, deeply nested Ion value. To remediate this issue, users should upgrade...

CVE-2026-96780

The figlet.js library (a JavaScript FIG driver) is vulnerable to a Denial of Service via an unbounded loop in its text() and textSync() functions. The root cause is that when the whitespaceBreak option is enabled and the width is set smaller than a single FIGlet character, the breakWord() functio...

CVE-2026-104183

The stream-json micro-library (versions prior to 3.6.0 ) is vulnerable to a prototype pollution flaw within its Assembler component. The root cause is the use of plain assignment to materialize object properties, which allows an input key named __proto__ to invoke an inherited setter. This result...

CVE-2026-104182

The stream-json micro-library is vulnerable to a Denial of Service (DoS) via a flaw in its JSONC parser (specifically at stream-json/jsonc/parser.js and stream-json/jsonc/verifier.js). Prior to version 3.6.0 , the parser restarts comment-terminator scanning from the opening slash whenever a block...

CVE-2026-104181

The Filament full-stack components for Laravel are vulnerable in versions 4.0.0 through 4.13.3 and 5.8.3 . The root cause is that app-based multi-factor authentication (MFA) management actions do not consistently require the current password for confirmation. An attacker with access to an authent...

CVE-2026-102514

PeaZip 11.2.0 and earlier versions are vulnerable to an Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component. The vulnerability occurs during PCOMPRESS1 stream decompression, where the 32-bit compsize field of the first bl...

CVE-2026-55396

The Teledyne FLIR Aware2 software, specifically in versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) , is vulnerable to the cleartext transmission of UDP traffic from the operator control unit to the robot. Because this traffic lacks a cryptographic integrity check , adjacent unauthenticat...

CVE-2026-55395

Teledyne FLIR Aware2 software (versions through 6.9.0.2 for PackBot and 1.7.9 for FirstLook) contains hardcoded passwords in the access control mechanism. This vulnerability allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots by extracting ...

CVE-2026-55394

Teledyne FLIR Aware2 software versions through 6.9.0.2 are vulnerable to unencrypted traffic transmission within the 802.11 network . This flaw allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic of Teledyne FLIR PackBot robots via network sniffing or hijacki...

CVE-2026-55393

Teledyne FLIR Aware2 software is vulnerable to a path traversal flaw in its web interface, affecting PackBot versions through 6.9.0.2 and FirstLook versions through 1.7.9 . This vulnerability arises from unvalidated pathnames , which allows remote unauthenticated attackers to access and read sens...

CVE-2026-14984

Teledyne FLIR Aware2 software, versions through 6.9.0.2 , is vulnerable to cleartext transmission in its primary control endpoints. This flaw allows remote unauthenticated attackers to intercept, hijack, or modify session traffic targeting Teledyne FLIR PackBot robots by sniffing or hijacking net...

CVE-2026-14983

Teledyne FLIR Aware2 software versions through 6.9.0.2 are vulnerable to a denial of service (DoS) attack due to missing authentication in the web interface. An unauthenticated remote attacker can exploit this by misusing the reboot endpoint on Teledyne FLIR PackBot robots running the affected so...

CVE-2026-53964

The Document Merge Service is vulnerable to Remote Code Execution (RCE) via Server-Side Template Injection (SSTI) in versions prior to 9.1.0 . The flaw exists because the xltpl library uses a non-sandboxed Jinja environment to process XLSX templates . An attacker can supply malicious template con...

CVE-2026-55252

OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0.17.7, the restrictions on redirect URLs in openrun can be bypassed by attackers, leading to open redirect attacks. This issue has been patched in version...

CVE-2026-55251

The NetBox Device Type Library is vulnerable to arbitrary code execution on its CI runner. A contributor with no special repository access could open a pull request modifying requirements.txt , .pre-commit-hooks-config.yaml / .pre-commit-yamlfmt-config.yaml , or .gitmodules files. The CI workflow...

CVE-2026-103484

A flaw in pgvector before version 0.8.7 allows an authenticated database user to trigger an out-of-bounds write during an Inverted File Flat (IVFFlat) index build operation. This vulnerability can lead to arbitrary code execution or a crash resulting in a denial of service on the database server....

CVE-2026-102628

The Cadmos LTI application (hosted at cadmos.eummena.io) was vulnerable because Laravel debug mode was enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessible environment. An unauthenticated attacker could trigger an unhandled exception via a GET request , causing the application to expo...

CVE-2026-100251

Versions of Wormhole.app deployed before 2026-08-22 are vulnerable to a server-side request forgery (SSRF) due to a misconfiguration in the coturn TURN server . The flaw arises because the application fails to properly restrict TCP relay peers , enabling an unauthenticated attacker to access inst...

CVE-2026-93832

A Motorola system application component was exported without permission , creating a security flaw that allows for the revocation of runtime permissions from other applications. The vulnerability is associated with CWE-862 (Missing Authorization) . No specific affected versions or remediation ste...

CVE-2026-102671

The Joyland AI app is vulnerable because its invisible advertisement WebView accepts invalid SSL certificates by default. This flaw falls under CWE-295 (Improper Certificate Validation), potentially allowing for man-in-the-middle attacks within that specific WebView component. No specific version...

CVE-2026-102670

The Joyland AI app is vulnerable because it explicitly permits cleartext HTTP traffic on devices running Android 9+ . This configuration deviates from the platform's default security behavior, which is to block such traffic, potentially exposing sensitive information during transmission. No speci...

CVE-2026-102669

The Joyland AI app is vulnerable to a security flaw because it does not verify hostnames . This improper validation of certificates with host mismatches (CWE-297) allows a malicious host to establish a connection or intercept chat messages . No specific exploit information or remediation details ...

CVE-2026-54049

The Sakai Collaboration and Learning Environment is vulnerable to stored cross-site scripting (XSS) in the Conversations tool (versions 23.0 to before 23.5, and 25.0 to before 25.3). The root cause is the lack of HTML sanitization when storing topic and post messages via the ConversationsServiceI...

CVE-2026-102668

The Joyland AI app is vulnerable to improper certificate validation because it accepts any TLS certificates from any server without validation. This flaw can allow attackers to intercept or manipulate communications. No specific remediation, exploit details, or affected versions were provided in ...

CVE-2026-102667

The Joyland AI app is vulnerable to a JavaScript injection flaw in its WebView component, exploitable by an attacker with shared network access . The root cause allows unauthorized access to the clipboard , app-internal storage , and the ability to make arbitrary HTTP requests via the Weex 'strea...

CVE-2026-82358

RT-Labs AB C-Open CANopen contains a write protection bypass in the SDO server implementation (src/co_sdo_server.c ). The vulnerability occurs because the system fails to properly validate write permissions when processing download-segment frames . An unauthenticated attacker on the CAN bus can i...

CVE-2026-102666

The Joyland AI app contains hard-coded credentials for the GeTui push notification service . This vulnerability allows an attacker to access the GeTui REST API to send push notifications with arbitrary content to any individual user, specific groups, or the entire user base of the app. No specifi...

CVE-2026-82357

The RT-Labs AB C-Open CANopen software contains a NULL pointer dereference vulnerability occurring when the LSS protocol is utilized to configure the device. The root cause is triggered if a user-defined application object lacks all required subindexes for object 0x1018 . An unauthenticated, remo...

CVE-2026-71542

GetSimple CMS CE , versions 3.3.22 and prior , is vulnerable to a stored Cross-Site Scripting (XSS) flaw within the "Theme to Components" functionality at the admin/components.php path. The vulnerability exists because the title parameter is rendered inside a double-quoted HTML attribute without ...

CVE-2026-71426

GetSimple CMS CE versions 3.3.22 and prior are vulnerable to a directory-traversal Local File Inclusion (LFI) . An authenticated user with page-editing rights can store an arbitrary filesystem path in a page's template attribute . When a visitor requests the affected page, this value is passed un...

CVE-2026-70650

In GetSimple CMS CE versions 3.3.22 and prior , an authenticated stored Cross-Site Scripting (XSS) vulnerability exists in the page backup viewer (admin/backup-edit.php ). While page fields are correctly HTML-encoded during the save process, the backup viewer utilizes htmldecode() or strip_decode...

CVE-2026-56662

GetSimple CMS CE versions prior to 1.5 are vulnerable to a Cross-Site Request Forgery (CSRF) attack due to a lack of anti-CSRF tokens and missing request-origin verification in the UpdateCE update form. A remote attacker can trick an authenticated administrator into visiting a malicious page that...

CVE-2026-56661

The GetSimple CMS CE community edition, prior to version 1.5 , is vulnerable to a Server-Side Request Forgery (SSRF) in its update handler. The application uses file_get_contents() to fetch a user-supplied URL, performing only basic format validation via FILTER_VALIDATE_URL without verifying the ...

CVE-2026-56660

The GetSimple CMS CE community edition (prior to version 1.5 ) is vulnerable to remote code execution (RCE) due to a flaw in the update handler located in UpdateCE.php . The application downloads and extracts ZIP archives into the web root without validating file types or extraction paths. This a...

CVE-2026-53953

In GetSimple CMS CE version 3.3.22 , the password reset endpoint is accessible without authentication. When a reset request is submitted for an existing user, the application generates a temporary password using PHP rand() seeded with microtime() . Because this seed is time-based and has a limite...

CVE-2026-104286

Fortinet FortiMail is vulnerable to a critical path traversal vulnerability (CVE-2026-104286 ) affecting versions 8.0.0–8.0.1, 7.6.0–7.6.6, 7.4.0–7.4.8, and 7.2.0–7.2.9 when the IBE function is enabled. The root cause involves a combination of Path Traversal (CWE-22) and insufficient neutralizati...

CVE-2026-27872

Johnson Controls Easy IO FG is affected by an Improper Privilege Management vulnerability (CWE-269) that allows for Brute Force attacks. This issue specifically impacts versions before 2.0b52 . While the vulnerability is documented, the provided documents do not specify the exact root cause, prac...

CVE-2026-84682

A command injection vulnerability exists in the TDDPv2 service (/usr/bin/tddp) on the Archer AX90 V1 router. An unauthenticated attacker on an adjacent network can exploit the setProductVer command handler to execute arbitrary operating system commands with root privileges during the device boot ...

CVE-2026-55232

The Vvveb CMS is vulnerable to a Server-Side Request Forgery (SSRF) (CWE-918) prior to version 1.0.8.6 . The root cause is an incomplete SSRF guard that uses an IPv4-only function , failing to inspect IPv6 addresses. Consequently, hosts lacking an A record bypass the private-range check. An authe...

CVE-2026-55230

The Vvveb CMS (prior to version 1.0.8.6 ) contains a Stored XSS vulnerability due to a flaw in the sanitizeHTML() filter. The HTML sanitizer fails to strip event-handler attributes when a tag contains a greater-than character inside a quoted attribute value. A low-privilege content author (such a...

CVE-2026-55231

The Vvveb CMS is vulnerable to a path traversal flaw in its central path sanitizer, specifically affecting versions prior to 1.0.8.6 . An authenticated user with backup access (e.g., site_admin role or higher) can exploit this to read and delete arbitrary files on the server. Impacted actions inc...

CVE-2026-103953

The Nessus software is affected by CVE-2026-103953 , which involves a Double Free vulnerability (CWE-415). This issue has a Medium severity with a CVSS v3 score of 4.9. The vulnerability was resolved in Nessus Version 10.12.5 . No specific exploit information or in-the-wild exploitation details a...

CVE-2026-103951

A High severity Out-of-bounds Write vulnerability (CWE-787) was identified in Nessus . The issue has been resolved in Nessus version 10.12.5 . No specific details regarding the root cause component or exploitability are provided in the documentation, but the vulnerability could potentially lead t...

CVE-2026-103948

The Nessus security scanner is affected by CVE-2026-103948 , which involves CWE-130: Improper Handling of Length Parameter Inconsistency . This vulnerability is classified as High severity with a CVSS v3 Base score of 7.2 . The issue has been addressed in Nessus Version 10.12.5 . No specific expl...

CVE-2026-103955

Nessus version 10.12.5 is affected by CVE-2026-103955 , which involves CWE-400: Uncontrolled Resource Consumption . This vulnerability is classified as Medium severity with a CVSS v3 Base score of 4.9 . Tenable has resolved this issue in version 10.12.5 ; however, specific technical details regar...

CVE-2026-103946

Tenable Nessus is affected by CVE-2026-103946 , a High severity SQL Injection vulnerability (CWE-89 ). The issue allows for unauthorized data access or manipulation. Tenable has addressed this vulnerability in Nessus Version 10.12.5 . No specific exploit links or in-the-wild exploitation details ...

CVE-2026-103954

The Nessus software (version 10.12.5 ) is affected by CVE-2026-103954 , which is caused by an out-of-bounds read (CWE-125). This vulnerability has a Low severity rating with a CVSS v3 score of 2.7. Tenable has addressed this issue in version 10.12.5 . No specific exploit details or in-the-wild ex...

CVE-2026-103952

The Nessus software is affected by CVE-2026-103952 , which involves a CWE-787: Out-of-bounds Write vulnerability. This issue has a Medium severity with a CVSS v3 Base score of 4.9 . The vulnerability has been addressed in Nessus Version 10.12.5 . Specific details regarding the root cause, affecte...

CVE-2026-103950

The Nessus software is affected by CVE-2026-103950 , which involves CWE-843: Access of Resource Using Incompatible Type (Type Confusion) . This vulnerability has a High severity rating with a CVSS v3 score of 7.2 . Tenable has addressed this issue in Nessus Version 10.12.5 . No specific exploit i...