Total
397489 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-69658 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions. | |||||
| CVE-2026-71396 | 2026-08-31 | N/A | 5.4 MEDIUM | ||
| Bendix EC80 Brake ECU uses hard-coded credentials, which could allow an attacker to disable automatic traction control. | |||||
| CVE-2026-78239 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| Xiiaozet LK100W exposes a critical management function that can be invoked without authentication, allowing a remote attacker to enable administrative services that should be restricted. Successful exploitation may permit unauthorized access to the device. | |||||
| CVE-2026-71187 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device. | |||||
| CVE-2026-78037 | 2026-08-31 | N/A | 8.8 HIGH | ||
| Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device compromise. | |||||
| CVE-2026-76179 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersonate an authenticated user and gain unauthorized access to device management functionality. | |||||
| CVE-2026-73125 | 2026-08-31 | N/A | 9.8 CRITICAL | ||
| Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability. | |||||
| CVE-2026-76945 | 2026-08-31 | N/A | 7.5 HIGH | ||
| The affected Ebyte device relies on client-managed authentication tokens without sufficient server-side validation. An attacker may replay or manipulate authentication tokens to gain unauthorized access to administrative functionality. | |||||
| CVE-2026-76060 | 2026-08-31 | N/A | 8.8 HIGH | ||
| An authenticated OS command injection vulnerability exists in ZoneMinder's event export functionality. The exportFile HTTP request parameter is passed unsanitized into a shell command executed via PHP's exec(), allowing any authenticated user with View Events permission to execute arbitrary operating system commands on the server. | |||||
| CVE-2026-77977 | 2026-08-31 | N/A | 8.1 HIGH | ||
| Ebyte gateway product's vendor configuration utility does not require authentication before allowing certain disruptive administrative actions when default credentials remain configured. An unauthenticated attacker on the adjacent network could reboot the device or restore factory settings, resulting in a loss of configuration and service availability. | |||||
| CVE-2026-75548 | 2026-08-31 | N/A | 5.4 MEDIUM | ||
| The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive actions. | |||||
| CVE-2026-73839 | 2026-08-31 | N/A | 4.6 MEDIUM | ||
| Administrative credentials may be exposed in plaintext within the Ebyte device's management interface, increasing the risk of credential compromise through visual or remote observation. This undermines the confidentiality of device access. | |||||
| CVE-2026-73809 | 2026-08-31 | N/A | 7.5 HIGH | ||
| A cleartext transmission of sensitive information vulnerability exists in certain Ebyte gateway products. The web management interface does not adequately protect sensitive communications using transport-layer encryption. An attacker with access to network traffic could intercept authentication or session-related information transmitted between a user and the affected device. Successful exploitation could result in disclosure of sensitive information and unauthorized access to device management functionality. | |||||
| CVE-2026-76940 | 2026-08-31 | N/A | 7.5 HIGH | ||
| The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication. | |||||
| CVE-2026-3686 | 2026-08-31 | N/A | 6.2 MEDIUM | ||
| IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 is vulnerable to a denial of service due to improper limitation of resources. | |||||
| CVE-2026-18527 | 2026-08-31 | N/A | 9.9 CRITICAL | ||
| IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticated profile gaining elevated privileges on the IBM i system. | |||||
| CVE-2026-82258 | 1 Svelte | 1 Sveltekit | 2026-08-31 | N/A | 4.8 MEDIUM |
| SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests. | |||||
| CVE-2026-82253 | 2026-08-31 | N/A | 7.5 HIGH | ||
| gitoxide (Rust crates gix <= 0.72.0 and gix-validate <= 0.10.0) contains a path traversal vulnerability. The submodule name validation function in gix-validate only checks the first occurrence of '..' via name.find(b".."), allowing crafted names such as 'a..b/../../../.git/' to bypass the check; additionally this validation is never invoked in production code paths. Combined with a trust inheritance flaw in Submodule::open(), where the parent repository's git_dir_trust (Trust::Full) is cloned and the ownership verification is skipped, an attacker can craft a malicious .gitmodules file so that a victim tool built on gitoxide reads arbitrary git repository configuration (including embedded credentials) with full trust, bypassing safe-directory protections. Fixed in gix 0.82.0 and gix-validate 0.11.1. | |||||
| CVE-2026-82248 | 2026-08-31 | N/A | 5.3 MEDIUM | ||
| gix-worktree-state before 0.33.0 (part of gitoxide) allows writing files outside the worktree on Windows. gix_worktree_state::checkout() follows an existing terminal symlink during non-exclusive (incremental) materialization (destination_is_initially_empty: false) when core.symlinks is true. If a symlink entry (mode 120000) is first checked out at a path P pointing outside the worktree, a subsequent incremental checkout of a regular-file entry (mode 100644) at the same path follows the existing reparse point and writes the blob content through the link, overwriting files outside the worktree. | |||||
| CVE-2026-82243 | 2026-08-31 | N/A | 7.6 HIGH | ||
| Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the datasource verify endpoint that allows builder-level users to supply arbitrary URLs without SSRF validation. Attackers can exploit this to leak internal CouchDB credentials by making requests to attacker-controlled servers, gaining full database access in cloud deployments. | |||||