Archive
5 August 2026
Vulnerabilities first published on this day (UTC), newest first.
16 results · Clear filters · Feed
-
High 8.4CVE-2026-17583 Public exploit
Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check
The affected Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.
-
High 8.6CVE-2026-18953 Public exploit
Improper limitation of a pathname to a restricted directory in aws-transform-mcp-server
Improper limitation of a pathname to a restricted directory in the get_resource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the s…
-
High 8.5CVE-2026-17633 Public exploit
Langflow OSS is affected by arbitrary code execution in component generation, validation, and custom component handling
IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to code injection.
-
Critical 9.9CVE-2026-20303 Public exploit
Cisco Catalyst SD-WAN Security Hardening Release - Input Validation Vulnerabilities
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple inter…
-
High 8.8CVE-2026-20200 Public exploit
Cisco Integrated Management Controller Argument Injection and Remote Code Execution Vulnerability
A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. T…
-
High 7.7CVE-2026-71294 Public exploit
Cotonti CMS Comments Plugin PHP Object Injection via Unrestricted unserialize() in Create/Edit Actions
Cotonti CMS's Comments plugin deserializes user-supplied data without restricting the classes that may be instantiated. In plugins/comments/controllers/actions/CreateAction.php, a POST parameter obtained via (trim-only sanitization) is passed to with no restr…
-
Critical 9.8CVE-2026-66747 Public exploit
ENDLESSDOORS: Zbtlink Router rctl/kworker Phone-Home Root Implant
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root un…
-
High 7.1CVE-2026-71211 Public exploit
mlflow - Unvalidated Gateway Secret api_base Enables SSRF via Gateway Proxy Endpoint
MLflow's AI Gateway accepts an auth_config.api_base value when creating a gateway secret (mlflow/server/handlers.py, _create_gateway_secret) with no validation of scheme, host, or IP range; the value is stored verbatim. The gateway proxy endpoint (mlflow/serv…
-
High 8.2CVE-2026-71206 Public exploit
shiori - JWT CheckToken Never Re-Validates Account State, Allowing Stale-Privilege Access After Deletion or Demotion
Shiori's CheckToken function (internal/domains/auth.go) validates only the JWT's HMAC signature and returns the embedded claims.Account object unmodified, never re-fetching the account from the database. No session store or token-revocation mechanism exists i…
-
Medium 6.5CVE-2026-71205 Public exploit
changedetection.io - No Rate Limiting on /login Enables Unlimited Password Brute-Force
changedetection.io's /login route checks the submitted password against a single PBKDF2-HMAC-SHA256 hash with no per-IP or per-session rate limiting, failed-attempt counter, or lockout (no rate-limiting library is present in requirements.txt).
-
Medium 6.3CVE-2026-71204 Public exploit
changedetection.io - Omitted Checkbox in /settings Save Silently Disables API Key Enforcement
changedetection.io's /settings save handler builds an update dict from form.data['application'] and blind-merges it into the stored application settings via .update.
-
Medium 5.3CVE-2026-71203 Public exploit
changedetection.io - Missing Authentication on /api/v1/full-spec Discloses Full OpenAPI Schema
changedetection.io's REST API resources are protected by an @auth.check_token decorator validating the caller's x-api-key header, except the Spec resource registered at /api/v1/full-spec (changedetectionio/api/Spec.py), whose get method carries neither @auth.…
-
Critical 9.6CVE-2026-70376 Public exploit
Pluck CMS - CSRF via Spoofable Missing-Referer Bypass Leads to Stored XSS and RCE
Pluck CMS's admin panel relies solely on a Referer-header comparison (requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action) for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area.
-
Medium 6.1
Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams() function using PHP's loose ine…
-
High 8.8CVE-2026-18322 Public exploit
Smart Popup by Supsystic <= 1.12.0 - Unauthenticated Privilege Escalation to Administrator
The Smart Popup by Supsystic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.12.0. This is due to a permission map collision in the `havePermissions()` function in `classes/frame.php`, where `array_merge()` o…
-
High 7.5CVE-2025-70962 Public exploit
Zosi C519M V4.2.8.823C01450BA is vulnerable to Incorrect Access Control. The application contains hardcoded credentials…