Total
94 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-118579 | 2026-10-29 | 10.0 HIGH | 9.8 CRITICAL | ||
| A weakness has been identified in D-Link DIR-505 1.10B02. The impacted element is the function main of the file /secmark1524.cgi of the component Web Management CGI. This manipulation of the argument accu/pass/code/hash/cmds causes backdoor. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. | |||||
| CVE-2026-114353 | 2026-10-28 | N/A | N/A | ||
| Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system(). | |||||
| CVE-2026-4621 | 1 Nec | 42 Aterm W1200ex-ms, Aterm W1200ex-ms Firmware, Aterm Wf1200cr and 39 more | 2026-10-26 | N/A | 5.6 MEDIUM |
| Hidden Functionality vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to enable telnet via network. | |||||
| CVE-2026-33280 | 1 Buffalo | 92 Fs-m1266, Fs-m1266 Firmware, Fs-s1266 and 89 more | 2026-10-26 | N/A | 9.8 CRITICAL |
| Hidden functionality issue exists in BUFFALO Wi-Fi router products, which may allow an attacker to gain access to the product’s debugging functionality, resulting in the execution of arbitrary OS commands. | |||||
| CVE-2026-1952 | 1 Deltaww | 2 As320t, As320t Firmware | 2026-10-26 | N/A | 9.8 CRITICAL |
| Delta Electronics AS320T has denial of service via the undocumented subfunction vulnerability. | |||||
| CVE-2026-7413 | 1 Yarbo | 4 Lawn Mower, Lawn Mower Firmware, Lawn Mower Pro and 1 more | 2026-10-26 | N/A | 7.2 HIGH |
| A hidden, persistent backdoor was found in Yarbo firmware v2.3.9 that provides remote, unauthenticated (or weakly authenticated) access to privileged functionality. The backdoor is undocumented, cannot be disabled via user-facing settings, and survives factory reset and ordinary firmware updates. | |||||
| CVE-2026-18191 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| VIN-DS783E-E6 developed by Vacron has a Hidden Functionality vulnerability, allowing unauthenticated remote attackers to exploit a specific hidden function to obtain the administrator credentials of the device. | |||||
| CVE-2026-61515 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise. | |||||
| CVE-2026-17032 | 2026-10-23 | N/A | 9.8 CRITICAL | ||
| Multiple Supsystic Pro plugins were distributed with malicious code through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage payload that exfiltrates credentials and other sensitive data and grants full control of affected sites. | |||||
| CVE-2026-97627 | 2026-10-20 | N/A | 7.2 HIGH | ||
| Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may execute arbitrary OS commands. | |||||
| CVE-2026-100737 | 2026-10-20 | N/A | 4.9 MEDIUM | ||
| Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to the product with the administrator privilege may upgrade the affected product to unauthorized firmware. | |||||
| CVE-2026-112360 | 2026-10-20 | 6.8 MEDIUM | 8.0 HIGH | ||
| A security vulnerability has been detected in Netis EAP930 1.250905.115454. This issue affects the function return200 of the file /cgi-bin/debug of the component CGI Endpoint. The manipulation of the argument SIGNATURE leads to backdoor. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is assessed as difficult. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-11673 | 2026-10-08 | N/A | 7.2 HIGH | ||
| SOOP-CLM developed by PiExtract has a Hidden Functionality vulnerability, allowing privileged remote attackers to exploit a hidden functionality to execute arbitrary code on the server. | |||||
| CVE-2025-58778 | 2026-10-08 | N/A | 7.2 HIGH | ||
| Multiple versions of RG-EST300 provided by Ruijie Networks provide SSH server functionality. It is not documented in the manual, and enabled in the initial configuration. Anyone with the knowledge of the related credentials can log in to the affected device, leading to information disclosure, altering the system configurations, or causing a denial of service (DoS) condition. | |||||
| CVE-2025-62773 | 2026-10-08 | N/A | 2.4 LOW | ||
| Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator. | |||||
| CVE-2026-82829 | 2026-10-01 | N/A | 9.8 CRITICAL | ||
| Hitachi Coding Software Suite contains a vulnerability related to Hidden Functionality vulnerability which allows an attacker to gain unauthorized access by exploiting hidden accounts or hard coded credentials. This issue affects Hitachi Coding Software Suite: through 3.3.0. | |||||
| CVE-2026-80217 | 2026-09-16 | N/A | 8.8 HIGH | ||
| Hidden functionality issue exists in FF-RFI079I4 and FF-RFI078I4, which may allow a user who can log in via SSH and access the enable mode on the product to execute arbitrary OS commands. | |||||
| CVE-2026-18844 | 2026-09-08 | N/A | 8.1 HIGH | ||
| The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued by the companion mobile application, yet are fully processed by the device when it is powered on. | |||||
| CVE-2026-11976 | 2026-08-26 | N/A | 10.0 CRITICAL | ||
| The official MonsterInsights Pro update distribution bucket (`monster-insights.s3.amazonaws.com`) was compromised. Both the current release (10.2.2) and the version MonsterInsights rolled back to (10.2.0) contain a malicious file, `class-system-check.php`. Three distinct variants were observed on 2026-06-11, all sharing the same AES-256-GCM key, confirming a single threat actor. The attacker retains write access to the S3 bucket and has been actively iterating on the payload throughout the day. | |||||
| CVE-2026-14812 | 2026-08-26 | N/A | 10.0 CRITICAL | ||
| The Premium SEO WordPress plugin is malicious: it ships an unauthenticated backdoor that creates a hidden administrator account and, in some builds, also enables remote code execution, server-side request forgery and arbitrary front-end script/content injection, giving an unauthenticated attacker full control of the affected site. | |||||