Archive
27 August 2026
Vulnerabilities first published on this day (UTC), newest first.
180 results · Clear filters · Feed
-
High 8.4
Dimension CSRF Vulnerability in Administrator Passphrase Change Endpoint
WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase t…
-
High 8.6
Dimension SQL Injection in Scheduled Report
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the scheduled report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sendin…
-
High 8.6
Dimension SQL Injection in Log Viewer
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the log viewer feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending spec…
-
High 8.7
Dimension Denial-of-Service
WatchGuard Dimension is susceptible to a denial-of-service condition when an attacker sends a high volume of TCP SYN packets to the log listening service.
-
High 8.6
Dimension SQL Injection in Audit Report
WatchGuard Dimension contains an authenticated SQL injection vulnerability in the audit report feature which allows an authenticated user with report administration permissions gain arbitrary command execution as the Dimension WebUI process user by sending sp…
-
High 8.7
Fireware OS Pre-Authentication Out-of-Bounds Read in iked Allows Denial of Service (DoS)
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
High 8.7
Fireware OS Integer Underflow in iked Allows Unauthenticated Denial of Service (DoS)
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
High 8.7
Fireware OS Integer Underflow in Iked Allows Unauthenticated Denial of Service (DoS)
An integer underflow vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
High 8.7
Fireware OS Pre-Authentication Double Free in iked Allows Denial of Service (DoS)
A double-free vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
High 8.7
Fireware OS Stack-Based Buffer Overflow in iked Allows Unauthenticated Denial of Service
A stack-based buffer overflow vulnerability in the WatchGuard Fireware OS iked process iallows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
High 8.6
Fireware OS Authenticated Buffer Overflow in wgagent
A buffer overflow vulnerability in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to cause a denial of service (DoS) condition or potentially execute arbitrary code by sending specially crafted network t…
-
High 8.7
Fireware OS Out-of-Bounds Read in iked Allows Unauthenticated Denial of Service (DoS)
An out-of-bounds read vulnerability in the WatchGuard Fireware OS iked process allows a remote unauthenticated attacker to create a Denial of Service (DoS) condition in VPN processing by sending specially crafted network traffic.
-
High 7.0
Wazuh: RBAC permission-effect check in mask_sensitive_config allows low-privilege users to read cluster.key
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.14.0 through 4.14.6, an authenticated low-privilege user can read the cluster secret from the manager configuration because th…
-
High 8.8
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code in…
-
High 7.1
Wazuh: Missing input validation in multiple active response scripts allows argument injection
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands witho…
-
High 8.1
Wazuh: Path traversal in ip-customblock active response allows arbitrary file creation and deletion
Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. The ip-customblock active response script contains a path traversal vulnerability that lets an attacker create or delete arbitrary files o…
-
High 8.2
cpp-httplib: Use-after-free of TLS session in WebSocketClient::shutdown_and_close()
cpp-httplib is a C++ header-only HTTP/HTTPS library. In versions 0.33.0 through 0.50.0, the TLS-enabled WebSocket client frees the TLS session before closing the WebSocket that still uses it, producing a use-after-free. In WebSocketClient::shutdown_and_close …
-
High 8.9
Buffer overflow in Bluetooth Mesh SDK when handling extended advertisements
In Bluetooth Mesh SDK 6.1.4 and earlier, malformed extended advertisements can trigger out-of-bounds writes leading to stack corruption and remote code execution. These messages must come from a device that has already joined the network. Only provisioners su…
-
High 7.9
Improper access control to the Synergis Softwire installation folder. This vulnerability affects Streamvault all-in-one…
-
High 8.1
Ebyte NA111-M Missing Authentication for Critical Function
Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the dev…
-
High 8.8
Xiiaozet LK100W OS Command Injection
Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to se…
-
High 7.5
Ebyte NE2-D11 Use of Client-Side Authentication
The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality.
-
High 7.5
Ebyte NE2-D11 Missing Authorization
Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality.
-
High 7.5
Ebyte NA111-M Improper Restriction of Excessive Authentication Attempts
The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authenti…
-
High 8.8
Ebyte NA111-M Cross-Site Request Forgery
The Ebyte device does not adequately verify the origin or authenticity of requests submitted to the web management interface. An unauthenticated remote attacker could persuade an authenticated administrator to visit a crafted page, causing unauthorized config…
-
High 7.5
Ebyte NA111-M Cleartext Transmission of Sensitive Information
A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network tr…
-
High 8.1
Ceph RGW SigV4 handler accepts unsigned x-amz-* headers on presigned requests, allowing privilege escalation
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway (RGW) SigV4 handler does not reject requests that carry x-amz-* headers absent from the signed heade…
-
High 7.5
Stack-based Buffer Overflow in Bendix EC80 Brake ECU
Bendix EC80 Brake ECU is vulnerable to a stack-based buffer overflow, which may allow an attacker to crash the ECU. A crafted payload can then be used to remotely execute arbitrary code or inject arbitrary CAN bus traffic. This could cause the loss of the ABS…
-
High 8.8
Ceph: CephX AES Authentication error
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway (RGW) protects STS session tokens with an AES-128-CBC handler that provides no message authentication, all…
-
High 8.9
Ceph: AES-CBC misuse in CephX and RADOSGW enables authentication bypass and credential forgery
Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the CephX authentication protocol encrypts tickets with AES-128-CBC in an unauthenticated mode that uses a hard-coded initia…
-
High 8.8
Missing Authorization in PayRange API
PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.
-
High 8.8CVE-2026-76060 Public exploit
OS Command Injection in PayRange API
An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events…
-
High 7.4
Improper Certificate Validation in ASE 2000
ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications.
-
High 8.2
Dolibarr 9.0.0 through 23.0.4 Path Traversal via EmailCollector Attachment Filename
Dolibarr 9.0.0 through 23.0.4 saves inbound email attachments under the name supplied in the message's MIME headers without reducing it to a safe basename. The global saveAttachment() in htdocs/emailcollector/lib/emailcollector.lib.php builds $filepath = $pat…
-
High 8.1
Dolibarr before 24.0.0 SQL Injection via the CSV and XLSX Import Update Keys
Dolibarr before 24.0.0 contains a SQL injection in its CSV and XLSX import wizard. The wizard reads its update keys with GETPOST('updatekeys', 'array') in htdocs/imports/import.php, which applies only the generic alphanohtml filter: that strips HTML but leave…
-
High 7.1
Zip Slip Arbitrary File Write in AWS diagram-as-code (awsdac)
A relative path traversal issue in the zip extraction functionality in AWS diagram-as-code (awsdac) in versions 0.10 through 0.23 can allow a third party to write arbitrary files to the local filesystem via crafted zip entry names containing path traversal se…
-
High 7.5
Trilium unauthenticated share-search discloses password-protected and hidden shared notes
Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to r…
-
High 8.1
Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature
Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticate…
-
High 7.1
Redis TLS pending-data list use-after-free
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the pri…
-
High 8.8CVE-2026-10036 Public exploit
SpeechBrain < 1.1.1 Arbitrary Code Execution via CKPT.yaml Parsing
SpeechBrain before 1.1.1 contains an arbitrary code execution vulnerability that allows attackers to execute arbitrary code by supplying a crafted CKPT.yaml checkpoint metadata file parsed with PyYAML's unsafe loader during candidate enumeration in Checkpoint…