Archive
28 September 2026
Vulnerabilities first published on this day (UTC), newest first.
316 results · Feed
-
High 7.2
Noobaa-core: noobaa-core: os command injection in cluster_internal_api.set_hostname_internal
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostnam…
-
High 7.3
dbgate Archive Link Creation archive.js createLink path traversal
A vulnerability was determined in dbgate up to 7.3.1. The impacted element is the function createLink of the file packages/api/src/controllers/archive.js of the component Archive Link Creation. This manipulation of the argument linkedFolder causes path traver…
-
Medium 5.9
Denial of Service in mH-DEVELOPER
mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is configured with a 250 MB limit for JSON and URL-encoded request bodies. An authenticated attacker on the LAN can send large r…
-
Medium 6.9
Use of End-of-Life components in mH-DEVELOPER
mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This exposes the device to publicly known vulnerabilities that will not receive security patches. An attacker could exploit …
-
Medium 6.0
Cleartext Transmission of Sensitive Information in mH-DEVELOPER
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and…
-
Medium 5.3
Missing Firewall Configuration in mH-DEVELOPER
mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every servi…
-
Medium 6.4
Missing Authentication in mH-DEVELOPER
mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated attacker on the LAN can query these endpoints, access system information,…
-
Medium 6.3
Use of Shared Cryptographic Key in mH-DEVELOPER
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man…
-
High 7.7
Undocumented access path in mH-DEVELOPER
mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can …
-
Medium 5.3
Thinkware U3000 TCP Service GET_STATUS information disclosure
A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the component TCP Service. The manipulation of the argument wifi_info results in information disclosure. The attack can be execu…
-
Unscored —
Hybrid Encapsulation from Seed Panics on Short Seed
For a hybrid KEM public key of type `PublicKey::WingKemDraft06` or `PublicKey::X25519MlKem768Draft06`, the `PublicKey::encapsulate_derand` function would panic in an indexing operation on a seed input of length shorter than 32 bytes. # Impact Applications enc…
-
High 8.8
Authenticated Arbitrary File Write
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.
-
Medium 5.3
Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control
A vulnerability was identified in Thinkware U3000 up to 1.02.04. Affected is the function get_file of the file /tmp/wpa_supplicant.conf of the component TCP Service. The manipulation leads to improper access controls. Remote exploitation of the attack is poss…
-
High 8.8
OS Command Injection in Packet-Capture (Sniffer) Filter leading to Remote Code Execution on Kubernetes Nodes
Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyone with access to NeuVector’s internal gRPC certificate key pair the ability to inject OS commands in the privileged enf…
-
Medium 6.5
Kubernetes kubectl cp path traversal on Windows allows arbitrary file writes
A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container to build a tar archive, transfers it over the network, and unpacks it on…
-
Medium 6.1
HTML Injection in Rolantis Information Technologies' Agentis
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows XSS Targeting HTML Attributes. This issue affects Agentis: from 4.44 bef…
-
High 7.3CVE-2026-101053 Public exploit
Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control
A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of the component TCP Service. Executing a manipulation of the argument path can lead to improper access controls. The atta…
-
Medium 6.3
Mint HTTP/1 client applies chunked framing when chunked is not the final transfer coding, enabling response smuggling through intermediaries
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize an intermediary and the Mint client on a pooled connection, poisoning the responses to subsequ…
-
Medium 6.3
Mint HTTP/2 client buffers oversized frames up to 16 MiB before enforcing max_frame_size
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client hold up to about 16 MiB per connection in frames it should reject, consuming client memory. Mint.HTTP2.Frame.decode_next…
-
High 8.2
HPACK-indexed cookie fields in Mint HTTP/2 responses bypass max_header_list_size and exhaust client memory
Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to exhaust memory on the client host and cause a denial of service. Mint.HTTP2 enforces the client's max_header_list_size setting only on t…
-
High 7.3
refly-ai refly JWT Token app.config.ts hard-coded credentials
A security vulnerability has been detected in refly-ai refly up to 1.1.0. This issue affects some unknown processing of the file apps/api/src/modules/config/app.config.ts of the component JWT Token Handler. The manipulation with the input test leads to hard-c…
-
Medium 6.5
Ricoh SP 330DN/SP 221/SP C252SF/Aficio SP 3500SF HTTP Multipart Form-Data denial of service
A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813. This affects an unknown part of the component HTTP Multipart Form-Data Parser. Performing a manipulation results in denial of service. The attack is …
-
High 7.2
Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.
-
High 8.3
Confused Deputy in Application Integration allows Internal File Read
A Confused Deputy vulnerability in the EmailTask component in Google Cloud Application Integration versions prior to 2026-06-30 on Google Cloud Platform allows an authenticated attacker to read and exfiltrate arbitrary Google-internal files via a crafted atta…
-
High 8.8
Authenticated PowerShell Injection leads to RCE
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
-
Critical 9.4
Deserialization of Untrusted Data in Application Integration allows Remote Code Execution
A Deserialization of Untrusted Data vulnerability in the JavaScript Task in Google Cloud Application Integration versions prior to 2026-06-28 on Google Cloud Platform allows an authenticated user with standard permissions to run arbitrary code on the shared p…
-
Critical 10.0
FAST FAC1900R devdiscover Service copy_msg_element stack-based overflow
A vulnerability was identified in FAST FAC1900R 20190827_2.0.2. Affected by this issue is the function copy_msg_element of the component devdiscover Service. Such manipulation leads to stack-based buffer overflow. The attack can be executed remotely. The expl…
-
High 8.8
Apache Karaf: OS Command Injection in Child-Instance Launch (instance:* / InstancesMBean)
Apache Karaf's instance-management service (InstanceServiceImpl) builds the command line used to launch a child Karaf JVM by string concatenation, then executes it through /bin/sh (Unix) or cscript (Windows). The caller-supplied javaOpts value is spliced into…
-
High 8.8
Authenticated File Write to RCE via keepalived in DDI Central
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentiall…
-
Critical 9.4
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's …
-
Critical 9.9
FAST FAC1200R MmtAtePrase stack-based overflow
A vulnerability was determined in FAST FAC1200R 5.0_20201119_1.0.2. Affected by this vulnerability is the function MmtAtePrase of the component MmtAtePrase Parser. This manipulation causes stack-based buffer overflow. Remote exploitation of the attack is poss…
-
Critical 9.9
FAST FAC1200R devdiscover Service parse_advertisement_frame stack-based overflow
A vulnerability was found in FAST FAC1200R 5.0_20201119_1.0.2. Affected is the function parse_advertisement_frame of the component devdiscover Service. The manipulation results in stack-based buffer overflow. The attack may be launched remotely. The exploit h…
-
Medium 4.8
Stored Cross-Site Scripting (XSS) in TPVEnlanube
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'. Successful exploitation …
-
Medium 4.8
Stored Cross-Site Scripting (XSS) in TPVEnlanube
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=com_virtuemart&page=admin.user_list'. Successful exploitation of th…
-
Medium 4.8
Stored Cross-Site Scripting (XSS) in TPVEnlanube
Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the following endpoint and parameter: * CVE-2026-7170: parameter 'vendor_store_name' in the endpoint '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[I…
-
Medium 5.3
FLB-Music FLB-Music-Player createParsedTrack.ts path.join path traversal
A vulnerability has been found in FLB-Music FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1. This impacts the function path.join of the file /src/main/core/createParsedTrack.ts. The manipulation leads to path traversal. The attack must be carried out locally. The ex…
-
High 7.3
Apache Karaf: LDAP filter injection in JAAS LDAP login modules
LDAPCache and LDAPBackingEngine build LDAP search filters for user lookup and role lookup by textually substituting the placeholders %u, %dn, and %fqdn (drawn from the login name, the resolved user DN, and its fully qualified namespace form) into administrato…
-
Medium 5.3
aligungr UERANSIM nr-gnb encode.cpp DecodePlainMmMessage uncaught exception
A flaw has been found in aligungr UERANSIM up to 3.3.0. This affects the function DecodePlainMmMessage in the library src/lib/nas/encode.cpp of the component nr-gnb. Executing a manipulation can lead to uncaught exception. The attack can be launched remotely.…
-
Medium 4.7
dayrui XunruiCMS Group Editing Home.php group_all_edit sql injection
A vulnerability was determined in dayrui XunruiCMS up to 4.7.2. This issue affects the function group_all_edit of the file dayrui/App/Member/Controllers/Admin/Home.php of the component Group Editing. This manipulation of the argument groupid causes sql inject…
-
Medium 6.5
Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional condition
A vulnerability was found in Trusted Domain Project OpenDMARC up to 1.4.2. This vulnerability affects the function strcasecmp in the library libopendmarc/opendmarc_policy.c. The manipulation results in handling of exceptional conditions. The attack can be exe…