Total
88 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-80217 | 2026-09-15 | N/A | 8.8 HIGH | ||
| Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands. | |||||
| CVE-2026-61515 | 2026-09-09 | N/A | 9.8 CRITICAL | ||
| Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise. | |||||
| CVE-2026-18844 | 2026-09-08 | N/A | 8.1 HIGH | ||
| The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on. | |||||
| CVE-2026-17032 | 2026-08-26 | N/A | 9.8 CRITICAL | ||
| Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites. | |||||
| CVE-2026-11976 | 2026-08-26 | N/A | 10.0 CRITICAL | ||
| The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day. | |||||
| CVE-2026-14812 | 2026-08-26 | N/A | 10.0 CRITICAL | ||
| The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site. | |||||
| CVE-2026-15413 | 2026-08-26 | N/A | 10.0 CRITICAL | ||
| The Link Factory WordPress plugin is a backdoor. Distributed as a "homepage sentence publisher", it exposes an operator-controlled REST API under /wp-json/link-factory/v1/ - authenticated by a detached Ed25519 signature verified against a hardcoded operator public key (except for the health check). | |||||
| CVE-2020-3352 | 1 Cisco | 1 Secure Firewall Threat Defense | 2026-08-11 | 1.9 LOW | 5.5 MEDIUM |
| A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to access hidden commands. The vulnerability is due to the presence of undocumented configuration commands. An attacker could exploit this vulnerability by performing specific steps that make the hidden commands accessible. A successful exploit could allow the attacker to make configuration changes to various sections of an affected device that should not be exposed to CLI access. | |||||
| CVE-2026-31847 | 1 Nexxtsolutions | 2 Nebula300plus, Nebula300plus Firmware | 2026-08-10 | N/A | 8.8 HIGH |
| Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23. | |||||
| CVE-2026-18191 | 2026-07-30 | N/A | 9.8 CRITICAL | ||
| VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device. | |||||
| CVE-2026-34769 | 1 Electronjs | 1 Electron | 2026-07-24 | N/A | 7.7 HIGH |
| Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Apps that construct webPreferences by spreading untrusted configuration objects may inadvertently allow an attacker to inject switches that disable renderer sandboxing or web security controls. Apps are only affected if they construct webPreferences from external or untrusted input without an allowlist. Apps that use a fixed, hardcoded webPreferences object are not affected. This issue has been patched in versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8. | |||||
| CVE-2026-41446 | 2026-07-24 | N/A | 9.8 CRITICAL | ||
| Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device label. Attackers with access to the device label or documentation containing these values can authenticate to the several endpoints and execute arbitrary commands as root on the device. | |||||
| CVE-2010-20103 | 1 Proftpd | 1 Proftpd | 2026-07-15 | N/A | 9.8 CRITICAL |
| A malicious backdoor was embedded in the official ProFTPD 1.3.3c source tarball distributed between November 28 and December 2, 2010. The backdoor implements a hidden FTP command trigger that, when invoked, causes the server to execute arbitrary shell commands with root privileges. This allows remote, unauthenticated attackers to run any OS command on the FTP server host. | |||||
| CVE-2026-4769 | 2026-07-13 | N/A | 9.8 CRITICAL | ||
| Certain devices in the WAGO System I/O Field series activate an internal diagnostic capability during the initial startup sequence. This functionality is not formally documented and becomes accessible without authentication for a brief period in the early boot phase. During this window, an unauthenticated remote attacker can gain access to the internal system processes, resulting in full system compromise. | |||||
| CVE-2026-7413 | 1 Yarbo | 4 Lawn Mower, Lawn Mower Firmware, Lawn Mower Pro and 1 more | 2026-06-17 | N/A | 7.2 HIGH |
| A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates. | |||||
| CVE-2026-4621 | 1 Nec | 42 Aterm W1200ex-ms, Aterm W1200ex-ms Firmware, Aterm Wf1200cr and 39 more | 2026-06-17 | N/A | 5.6 MEDIUM |
| Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network. | |||||
| CVE-2026-3587 | 2026-06-17 | N/A | 10.0 CRITICAL | ||
| An unauthenticated remote attacker can exploit a hidden function in the CLI prompt to escape the restricted interface, leading to full compromise of the device. | |||||
| CVE-2026-33280 | 1 Buffalo | 92 Fs-m1266, Fs-m1266 Firmware, Fs-s1266 and 89 more | 2026-06-17 | N/A | 9.8 CRITICAL |
| Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands. | |||||
| CVE-2026-30704 | 2026-06-17 | N/A | 9.1 CRITICAL | ||
| The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) exposes an unprotected UART interface through accessible hardware pads on the PCB | |||||
| CVE-2026-1952 | 1 Deltaww | 2 As320t, As320t Firmware | 2026-06-17 | N/A | 9.8 CRITICAL |
| Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability. | |||||