Archive
5 September 2026
Vulnerabilities first published on this day (UTC), newest first.
133 results · Feed
-
Critical 9.1
Tenda CP3 Network Configuration Management system.c sub_2F77E8 os command injection
A vulnerability was detected in Tenda CP3 27.5.57.101. The affected element is the function sub_2F77E8 of the file Apis/system.c of the component Network Configuration Management. Performing a manipulation results in os command injection. The attack may be in…
-
Medium 4.1
Tenda CP3 hostapd hard-coded credentials
A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Such manipulation of the argument wpa_passphrase leads to hard-coded credentials. The attack can be launched remotely. Th…
-
Critical 9.1
Tenda CP3 NetCheckPing.cpp os command injection
A weakness has been identified in Tenda CP3 27.5.57.101. This issue affects some unknown processing of the file Net/NetCheckPing.cpp. This manipulation of the argument interface_name/host causes os command injection. The attack can be initiated remotely.
-
Critical 9.1
Tenda CP3 Kylin system.c SystemAsh os command injection
A security flaw has been discovered in Tenda CP3 27.5.57.101. This vulnerability affects the function SystemAsh of the file Apis/system.c of the component Kylin. The manipulation of the argument AlarmVoiceURL results in os command injection. It is possible to…
-
Critical 9.2
SSH session privilege manipulation via a crafted username in Mikrotik RouterOS
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be changed, leading to privilege escalation. Exploitation requires an unauthenticate…
KEV Sep 10, 2026 -
High 8.7CVE-2026-67281 Public exploit
Unauthenticated file read in Mikrotik RouterOS
RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that…
-
Medium 6.3
TLS server impersonation possible in Mikrotik RouterOS
MikroTik RouterOS accepts malformed RSA/PKCS#1 v1.5 signatures across RSA-based services, including TLS/X.509 certificate validation and SSH host-key authentication. Because its trust store includes an e=3 root CA, an attacker controlling or redirecting an ou…
-
Medium 6.9
SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS
RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the…
KEV Sep 25, 2026 -
High 8.8CVE-2026-67277 Exploited
Kernel memory disclosure and denial of service in MikroTik RouterOS btest service
RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use this state to start an IPv4 UDP test. With "random-data=false", the sender transmits an uninitialized tail f…
KEV Sep 10, 2026 -
Critical 9.2
SSH user impersonation possible in Mikrotik RouterOS
RouterOS does not compare the complete RSA public key when matching an SSH authentication request to an authorized user key, checking the key type and modulus but omitting the exponent. Because signature verification uses the client-supplied key, an attacker …
-
Medium 6.9CVE-2026-86206 Scanner template
Access control filter bypass allows unauthorised access to APIs
A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central 2026.3 HF3 and 2026.4
-
High 7.7CVE-2026-86207 Scanner template
Authentication bypass leads to unauthorised access to N-central
An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs
-
Medium 5.0
OOBR in rpcap client in libpcap before 1.10.7
The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious server can send a crafted message and cause the client to treat up to 20 bytes of the client process memory beyond the end …
-
Medium 4.3
rpcapd memory leak in libpcap before 1.10.7
rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it never frees the memory, so it leaks memory even under normal use. A malicious client can cause the server to leak memo…
-
High 7.5
infinte loop in libpcap before 1.10.7
libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it does not limit the number of loop iterations. A crafted filter program or the 'protochain' primitive used on a crafted …
-
Medium 5.5
division by zero in libpcap before 1.10.7
libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular uncommon use cases a crafted filter program can cause a division by zero.
-
Medium 5.5
abort() in libpcap before 1.10.7 on an invalid BPF opcode
libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a crafted filter program can terminate the OS process.
-
Medium 5.5
OOBR in libpcap before 1.10.7
libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a jump instruction with an offset that translates to a pointer outside of the buffer. In particular uncommon use cases a cr…
-
High 8.7
OOBR and OOBW in libpcap before 1.10.7
In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not exceed 15, but libpcap BPF interpreter does not validate the value. In particular uncommon use cases a crafted filter p…
-
Medium 5.9
Ash string length constraints count graphemes, so a combining-mark string of any size passes max_length
Improper Validation of Specified Quantity in Input vulnerability in ash-project ash allows an attacker to store a value of arbitrary size in an attribute whose length constraint should bound it. Ash measures string length with Elixir's String.length/1, which …
-
Medium 5.1
Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox
Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets…
-
High 8.7
Grav API Plugin before 1.0.20 Authentication Bypass via Host Header
Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing unauthenticated attackers to redirect reset tokens to attacker-controlled domains. Attackers can send password reset req…
-
Medium 6.9
Grav Form Plugin before 9.1.22 Cross-Page Form Execution
Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form actions defined on login-restricted or unpublished pages. Attackers can POST to any public page with a res…
-
High 8.7
grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag
grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags() method only removes nested super flags but fails to strip dot-keyed equivalents like api.super. A non-super user manag…
-
High 8.7
Grav API Plugin Authentication Bypass via Group-Inherited Super
grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user managers to modify super-admin accounts. Attackers with api.access and api.users.write can patch password fields on group-supe…
-
Medium 6.5
SiYuan before v3.8.2 Information Disclosure via Attribute-View
SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish readers can retrieve hidden KeyValues payloads from rows bound to inaccessible documents, exposing private database contents…
-
Medium 4.3
SiYuan before v3.8.2 Private Attribute View Key Enumeration
SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can …
-
Critical 9.1
WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter
WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password hashes, recovery tokens, and live session identifiers to unauthenticated callers when a hash parameter is provided. At…
-
High 7.2
AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages wit…
-
Critical 9.8
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
WWBN AVideo contains a path traversal vulnerability in notify.ffmpeg.json.php that allows unauthenticated attackers to write files to arbitrary locations by supplying a caller-chosen path in the avideoRelativePath parameter. Attackers can replay any previousl…
-
Medium 5.9
WWBN AVideo Weak PRNG Password Generation via External Login
WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integers. Attackers with access to password hashes can recover plaintext passwords in minutes through offline brute-force atta…
-
Medium 6.5
AVideo API Rate Limit Bypass via Bot User-Agent Header
AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operations including login brute-force protection. Attackers can send requests with a bot User-Agent to disable rate limiting a…
-
High 8.0
Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass
Bilibili Desktop through 1.18.0 disables TLS certificate verification process-wide and executes unsigned remote JavaScript configuration without integrity checks. An attacker in an on-path network position can intercept configuration fetches, inject arbitrary…
-
Critical 9.8
Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route
Lara Dashboard before 1.3.0 contains an authentication bypass vulnerability in the screenshot-login route that allows unauthenticated attackers to authenticate as any user by email when APP_ENV is not production. Attackers can request the GET /screenshot-logi…
-
Low 3.3
ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression
ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attackers can supply malformed .Z files that cause the decompressor to read one byte past the allocated heap buffer, potentiall…
-
Medium 5.5
CDT before 1.4.5 Out-of-Bounds Read via opposedVertexInd
CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are computed in floating point and round outside adjacent triangles. Attackers can supply nearly-degenerate constraint edges th…
-
High 8.8
Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover
The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_account_member_permissions' function in all versions up to, and including, 1.6.4. This makes it possib…
-
Medium 4.3
Ninja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook
The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack of capability checks and nonce verification in the 'bulk_actions' function. This makes it possible fo…
-
Critical 9.8CVE-2026-10196 Public exploit
Mail Mint <= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields
The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.31.0 via deserialization of untrusted input in the 'handle_form_submission' f…
-
Medium 5.4
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint
The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to e…