Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass...
CVE-2026-9141
Taiko AG1000-01A SMS Alert Gateway Rev 7.3 and Rev 8 contains an authentication bypass vulnerability in the embedded web
#severity:critical
共收录 1443 条相关情报。
← 返回所有主题A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController...
CVE-2026-9129
A path traversal vulnerability exists in the Altium Enterprise Server Viewer StorageController due to improper handling
A potential security vulnerability has been identified in the HP Linux Imaging and Printing...
CVE-2026-8631
A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software. This potential vul
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For...
CVE-2026-45444
Unrestricted Upload of File with Dangerous Type vulnerability in WP Swings Gift Cards For WooCommerce Pro allows Using M
A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to...
CVE-2026-9102
A path traversal vulnerability exists in the Altium Enterprise Server ComparisonService due to missing filename sanitiza
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload...
CVE-2026-20223
A vulnerability in the access validation of internal REST APIs of Cisco Secure Workload could allow an unauthentica
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras....
CVE-2026-8598
An undocumented configuration export port is accessible on some models of ZKTeco CCTV cameras. This port does not requi
Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)
CVE-2026-46421
## Impact On April 29, 2026, compromised versions of `@cap-js/sqlite@2.2.2`, `@cap-js/postgres@2.2.2`, and `@cap-js/db-
The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and...
CVE-2026-7637
The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deseria
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an...
CVE-2026-24207
NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause an authentication bypass. A succes
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable...
CVE-2026-7284
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions...
CVE-2026-6555
The ProSolution WP Client plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including,
Malicious code in @beproduct/nestjs-auth (0.1.2 through 0.1.19) — Mini Shai-Hulud worm
CVE-2026-46412
## Summary Between 2026-05-11 20:19 UTC and 22:56 UTC, an attacker used a compromised npm publish token to publish 18 m
Coder: PKCS#7 signature bypass in Azure instance identity allows unauthenticated agent token theft
CVE-2026-46354
## Summary `azureidentity.Validate()` verifies that the PKCS#7 signer certificate chains to a trusted Azure CA but neve
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path
## Summary The MCP router (ext_proc) exposes an `initialize`-method code path that, when a request carries an `mcp-ini
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame...
CVE-2026-8836
A vulnerability was found in lwIP up to 2.2.1. Affected is the function snmp_parse_inbound_frame of the file src/apps/sn
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to...
CVE-2026-42822
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges ove
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB...
CVE-2026-45829
A pre-authentication, code injection vulnerability in version 1.0.0 or later of the ChromaDB Python project allows an un
Malicious dropper in mistralai 2.4.6 PyPI package
The `mistralai` PyPI package version `2.4.6` contains a malicious dropper that executes on import on Linux. No `v2.4.6`
Formie: Pre-authenticated server-side template injection in Hidden fields
CVE-2026-45697
### Impact - Unauthenticated users could submit crafted values into Hidden fields (with Default value → Custom) that wer