CVE-2026-93290

The Eufy Omni C20 is affected by a vulnerability involving the use of hard-coded credentials . An attacker who is able to monitor the device's log files could obtain these credentials to gain unauthorized access to sensitive information, such as mapping data . No specific remediation or patch ver...

CVE-2026-93289

The Eufy Omni C20 and Omni X10 Pro are vulnerable to an OS command injection attack. This vulnerability allows an unauthenticated attacker to execute arbitrary system commands during the pairing process . While the specific root cause is not detailed in the provided documents, the impact is signi...

CVE-2026-97324

The YunaiV/zhijiantianya ruoyi-vue-pro application (up to version 2026.08) is vulnerable to improper authorization in the Demo-order Payment Callback Handler component. Specifically, the updateDemoOrderPaid function in yudao-module-pay/src/main/java/cn/iocoder/yudao/module/pay/controller/admin/de...

CVE-2026-82372

Brocade SANnav versions prior to 3.0.1a are vulnerable to improper handling of sensitive data during IPsec policy creation and modification. This flaw causes pre-shared keys to be recorded in application logs, potentially exposing credentials used to secure network tunnels to individuals with rea...

CVE-2026-82164

Dell Trusted Device Client versions prior to 8.1.359.0 are vulnerable to an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this flaw to cause Information tampering . No specific exploit details or in-the-w...

CVE-2026-96883

The AWS pgcollection PostgreSQL extension versions 2.0.0 through 2.1.1 are vulnerable to a type confusion issue. An authenticated remote user can execute arbitrary code as the postgres operating system user by sending crafted SQL statements that exploit mismatched type metadata during collection ...

CVE-2026-97323

A path traversal vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (up to version 2026.08). The flaw resides in the getOriginalFilename function within the file yudao-module-mp/src/main/java/cn/iocoder/yudao/module/mp/service/material/MpMaterialServiceImpl.ja...

CVE-2026-89325

The Rapid7 Insight Agent on Windows is vulnerable to local privilege escalation due to an uncontrolled search path element in InsightVM assessment content. Assessment content at or below version 0.0.261.0 invoked the code command without a fully qualified path from a process running as SYSTEM . A...

CVE-2026-86860

The ServiceNow AI Platform contains a missing authorization vulnerability that could allow an unauthenticated user to extract instance data beyond intended limits, potentially leading to privilege escalation . ServiceNow has released security updates for hosted instances and provided updates for ...

CVE-2026-56792

Versions prior to 5.2.206 of Dell Rugged Control Center (RCC) are affected by an Improper Authorization vulnerability. A low privileged attacker with local access could potentially exploit this flaw to achieve Elevation of Privileges . No specific exploitation details or exploit links are provide...

CVE-2026-81473

Versions prior to 5.2.206 of Dell Rugged Control Center (RCC) are affected by an Improper Authorization vulnerability. A low-privileged attacker with local access could exploit this flaw to achieve Elevation of Privileges . While specific technical details regarding the root cause are not provide...

CVE-2026-86859

The ServiceNow AI Platform is affected by an authorization bypass security issue. If exploited, an unauthenticated user could gain access to data within the platform that they are not entitled to see, potentially leading to further unintended access. ServiceNow has already deployed a security upd...

CVE-2026-13016

The ServiceNow AI Platform contains a SQL injection vulnerability that could allow an unauthenticated user to execute arbitrary SQL statements against the instance's underlying database. Successful exploitation could result in unauthorized access to, or modification of, instance data. ServiceNow ...

CVE-2026-97322

A cross-site scripting (XSS) vulnerability exists in the File Upload component of YunaiV/zhijiantianya ruoyi-vue-pro (versions up to 2026.08). The flaw affects an unspecified function within the file yudao-module-infra/src/main/java/cn/iocoder/yudao/module/infra/controller/admin/file/FileControll...

CVE-2026-81455

Dell ThinOS 10 versions prior to SecurityAddon_2605.10.2766_T10 are susceptible to a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with remote access can exploit this flaw to gain Unauthorized access . For remediation, users should apply the security upda...

CVE-2026-57440

The EmbedVideo Extension for MediaWiki is vulnerable to HTML/JavaScript injection in versions prior to 4.1.0 . When the $wgEmbedVideoRequireConsent setting is disabled, the extension fails to sanitize video URLs passed into an iframe src attribute. An attacker can provide a malformed URL or ID us...

CVE-2026-86858

An improper access control security issue exists in the ServiceNow AI Platform , which could allow an unauthenticated user to create, modify, or delete instance data beyond intended limits. The CVELIST document specifies this as an Unauthenticated Privilege Escalation via GraphQL . ServiceNow rel...

CVE-2026-82157

Dell ThinOS 10 versions prior to SecurityAddon_2605.10.2766_T10 are affected by an Improper Certificate Validation vulnerability. An unauthenticated attacker with adjacent network access can exploit this flaw to achieve a protection mechanism bypass and gain unauthorized access . Remediation is a...

CVE-2026-86857

An authorization bypass vulnerability exists in the ServiceNow AI Platform . This flaw could allow an authenticated user to access data they are not entitled to, potentially leading to further unintended access. ServiceNow has remediated the issue and deployed updates to hosted instances, providi...

CVE-2026-48073

The collaborative wiki software Docmost is vulnerable to an unauthorized data exposure flaw in versions 0.70.0 through 0.80.1 . A low-privileged authenticated user capable of editing an exportable page can embed a forged attachmentId belonging to a restricted page within the same space. When the ...