BaselineWatch
9186 unread
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in
Register Tracker canaries (EasyPrivacy) 202610271409: first version Tue 27 Oct·Ad canaries (EasyList) 202610271405: 2 changed Tue 27 Oct·NIST SP 800-171 Rev 3 (CUI; CMMC Level 2) OSCAL 1.1.0: first version 22 Oct·the register

News · NVD CVE API 2.0

All News Vendor advisories Known exploited Notable CVEs Releases Unread only
  • NVD CVE API 2.0

    CVE-2026-111708 · CVSS 9.3

    WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated attackers to self-register as administrators via POST /auth/signup. Attackers can omit the profile field or set it to admin, gaining user management, settings, and access to all tickets, contacts, messages, and WhatsApp connections.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111708
  • NVD CVE API 2.0

    CVE-2026-111704 · CVSS 9.3

    LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST controllers because no Sa-Token interceptor is registered. Attackers can query /api/v1/auth/users to read plaintext passwords, retrieve LLM provider API keys, create super-admin accounts, and modify or delete data.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111704
  • NVD CVE API 2.0

    CVE-2026-111693 · CVSS 9.3

    DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credentials to /webapi/api/v1/auth/login to obtain an administrator token and access all protected /webapi routes.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111693
  • NVD CVE API 2.0

    CVE-2026-111692 · CVSS 9.3

    DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of admin and a future expiry with the default dev-secret to gain full administrative access to protected /webapi routes, including the Doris SQL query API.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111692
  • NVD CVE API 2.0

    CVE-2026-111691 · CVSS 9.1

    WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege level by sending an unsigned X-USERINFO header. Attackers reaching backend service ports directly, bypassing the gateway, can forge companyid and manager or admin usertype values to read and modify other tenants' orders, finance data, and Amazon seller authorizations.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111691
  • NVD CVE API 2.0

    CVE-2026-111690 · CVSS 9.3

    Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge super administrator tokens by using the hard-coded Auth.AccessSecret in api/etc/core.yaml. Attackers can sign a JWT with the public secret and roleId claim 001 to gain full administrative control over users, roles, menus, API authorities, configuration and tokens.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111690
  • NVD CVE API 2.0

    CVE-2026-111687 · CVSS 9.3

    WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111687
  • NVD CVE API 2.0

    CVE-2026-111675 · CVSS 9.1

    Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated attackers to brute force 6-digit SMS/email verification codes, which are never invalidated or attempt-limited. Attackers who know a victim's phone or email can trigger a code and rotate source IPs against the password reset and verify login endpoints to take over accounts.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111675
  • NVD CVE API 2.0

    CVE-2026-111673 · CVSS 9.3

    IceCMS through 4.1.5 contains a missing authentication vulnerability that allows unauthenticated attackers to modify, delete, or disable any account because /User/** is excluded from the Shiro jwt filter. Attackers can send PUT requests to /User/updateUser to set a new password and role on any userId, including administrators, enabling full account takeover.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111673
  • NVD CVE API 2.0

    CVE-2026-111663 · CVSS 9.2

    Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via the createUrlUpload GraphQL mutation. Attackers can submit internal URLs, including cloud instance metadata endpoints, through POST /graphql and retrieve the full response via the returned ActiveStorage blob URL.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111663
  • NVD CVE API 2.0

    CVE-2026-111643 · CVSS 9.3

    Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers to write arbitrary configuration keys via the unprotected POST /api/ui/config-history/rollback endpoint. Attackers can set the ipWhitelist key to their own /32 address, or alter trustedProxies and webhookApiKey, to access every protected endpoint as the administrator.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111643
  • NVD CVE API 2.0

    CVE-2026-111641 · CVSS 9.3

    FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any user by abusing unprotected auto-login endpoints. Attackers can list users via /api/v1/auth/auto-login/users, mint a superuser auto-login token, and exchange it for a JWT session to gain full administrative control.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111641
  • NVD CVE API 2.0

    CVE-2026-111636 · CVSS 9.2

    OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator session tokens using the hard-coded default app_secret. Attackers can sign an HMAC-SHA256 token for the seeded 'admin' user in 'tenant_demo' to gain full tenant administration, including stored model and channel credentials.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111636
  • NVD CVE API 2.0

    CVE-2026-111626 · CVSS 9.3

    Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administrator accounts, or POST /api/users to reset any user's password, gaining full control.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111626
  • NVD CVE API 2.0

    CVE-2026-109588 · CVSS 9.3

    Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on the Arm Cortex-R82 (Armv8-R AArch64) MPU port might allow, under certain conditions, an unprivileged task on MPU-enabled builds to read or write privileged kernel memory beyond the validated buffer window, via a stream buffer system call. To remediate this issue, users should upgrade to version V11.3.2 or later.

    Fix: vendor advisory: AWS Security Bulletins Fix panel

    detailsCVE-2026-109588
  • NVD CVE API 2.0

    CVE-2026-109587 · CVSS 9.3

    Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might allow an unprivileged task on MPU-enabled builds to read and write privileged kernel memory outside the regions assigned to it, via a buffer argument passed to an MPU system call. To remediate this issue, users should upgrade to version V11.3.2 or later.

    Fix: vendor advisory: AWS Security Bulletins Fix panel

    detailsCVE-2026-109587
  • NVD CVE API 2.0

    CVE-2026-102551 · CVSS 9.2

    Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router Advertisement. To remediate this issue, users should upgrade to version V4.4.2.

    Fix: vendor advisory: AWS Security Bulletins Fix panel

    detailsCVE-2026-102551
  • NVD CVE API 2.0

    CVE-2026-92262 · CVSS 9.9

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.

    Fix: 1 public exploit · 3 patch or advisory references on NVD Fix panel

    detailsCVE-2026-92262
  • NVD CVE API 2.0

    CVE-2026-85748 · CVSS 9.9

    MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2.

    Fix: 3 patch or advisory references on NVD Fix panel

    detailsCVE-2026-85748
  • NVD CVE API 2.0

    CVE-2026-85746 · CVSS 9.9

    MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.

    Fix: 2 patch or advisory references on NVD Fix panel

    detailsCVE-2026-85746
  • NVD CVE API 2.0

    CVE-2026-57169 · CVSS 9.6

    Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers/<id>/exec does not enforce authentication on the WebSocket upgrade request. When an unauthenticated attacker has network reach to Dockhand, knows a target container ID, and targets a container with an interactive shell, the attacker can open a raw WebSocket terminal session and execute commands inside a known target container. This allows unauthenticated command execution inside the container, with possible host compromise when the container has sensitive mounts or privilege

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-57169
  • NVD CVE API 2.0

    CVE-2026-49868 · CVSS 9.8

    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, _parse_reply() in sys/net/application_layer/dhcpv6/client.c omits minimum-length validation before passing IA_PD and IA_NA option bodies to sub-option parsers. A malicious or compromised DHCPv6 server can send a REPLY with an option length smaller than the required structure while MODULE_DHCPV6_CLIENT_IA_PD is enabled, causing _parse_ia_pd_option to read past the option body, size_t underflow, and unbounded out-of-bounds heap reads that can crash the dev

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-49868
  • NVD CVE API 2.0

    CVE-2026-102693 · CVSS 9.6

    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.04, the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function uses strcpy to copy an SSID without checking the destination size. When MODULE_ATWINC15X0_DYNAMIC_CONNECT is enabled, a nearby attacker can advertise a malformed or oversized SSID that is processed during Wi-Fi scanning, causing memory corruption and potentially a hard fault, denial of service, or code execution. This issue is fixed in version 2026.04.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-102693
  • NVD CVE API 2.0

    CVE-2026-102692 · CVSS 9.1

    RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07, nanocoap accepts oversized CoAP Block2 option values without enforcing the 20-bit maximum block number, allowing block offset multiplication to overflow on 32-bit targets. The affected master baseline is commit aeeae69e; the verified fix is later on master and remains unreleased. The oversized value passes from coap_get_blockopt() to coap_block_slicer_init(). A remote CoAP client can send a malformed Block2 option that produces an invalid slice range and

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-102692
  • NVD CVE API 2.0

    CVE-2026-44977 · CVSS 9.0

    countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-44977
  • NVD CVE API 2.0

    CVE-2026-105279 · CVSS 9.3

    In the default configuration, the archive accepts DICOM associations from an unregistered calling AE. A remote peer can use C-FIND and C-GET to enumerate and retrieve patient information and medical images. It can also use C-STORE to file fabricated study content under an existing patient identity.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-105279
  • NVD CVE API 2.0

    CVE-2026-18516 · CVSS 9.6

    An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-18516
  • NVD CVE API 2.0

    CVE-2026-107617 · CVSS 9.3

    An attacker can use a hard-coded credential to log in to EseeCloud devices.

    Fix: vendor advisory: CISA ICS Advisories Fix panel

    detailsCVE-2026-107617
  • NVD CVE API 2.0

    CVE-2026-111391 · CVSS 9.2

    SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers to execute Python code by escaping the eval() sandbox through re.search __globals__. Attackers can send a crafted filter expression to the unauthenticated /dumper/configure endpoint when DUMPER_SERVER_PORT is set, running code in the scheduler process on the next forward pass.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111391
  • NVD CVE API 2.0

    CVE-2026-111472 · CVSS 9.3

    An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update and delete data from the database by sending a GET request using the ‘Identificación’ parameter of the ‘/cgi-bin/index.php’ endpoint.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111472
  • NVD CVE API 2.0

    CVE-2026-94388 · CVSS 9.3

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-popups allows Blind SQL Injection.This issue affects Green Popups: from n/a before 7.6.3.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-94388
  • NVD CVE API 2.0

    CVE-2026-94169 · CVSS 10.0

    Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue affects The Grid: from n/a through 2.8.1.

    Fix: 1 public exploit Fix panel

    detailsCVE-2026-94169
  • NVD CVE API 2.0

    CVE-2026-104730 · CVSS 9.8

    The Sunshine Photo Cart – Client Photo Gallery & Photo Proofing for Photographers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.7.4 via deserialization of untrusted input . This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attac

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-104730
  • NVD CVE API 2.0

    CVE-2026-89079 · CVSS 9.8

    The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1. This is due to the plugin not properly validating a user's identity prior to updating their password. This makes it possible for unauthenticated attackers to change arbitrary user's passwords on multi-site setups in certain configurations.

    Fix: 1 public exploit Fix panel

    detailsCVE-2026-89079
  • NVD CVE API 2.0

    CVE-2026-103768 · CVSS 9.8

    The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.3.7 via the initMailPart function. This is due to insufficient file type validation when saving IMAP email attachments. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-103768
  • NVD CVE API 2.0

    CVE-2026-109515 · CVSS 9.8

    The MailOptin – Popup, Optin Forms & Email Newsletters for Mailchimp, HubSpot, AWeber Etc. plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.78.6 This is due to the `subscribe_to_email_list` endpoint accepting an attacker-supplied `optin_data[form_custom_field_mappings]` parameter without any allow-list validation on destination keys, allowing the attacker-controlled mapping to override the administrator's saved mapping and pass arbitrary `wp_users` column names — including `ID` and `user_pass` — directly into `wp_insert_user()` via the `subsc

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-109515
  • NVD CVE API 2.0

    CVE-2026-109219 · CVSS 9.8

    The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.4.4 via the mbw_file_upload function. This is due to missing file extension validation on the attacker-supplied image_path parameter, whose basename-derived file name bypasses the extension allowlist applied only to the separate file_name parameter. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Exploitation requires the board to be configured to allow guest posts, which is the plugin's defau

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-109219
  • NVD CVE API 2.0

    CVE-2026-104798 · CVSS 9.8

    The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.8.7. The public `mcs` GET parameter is reflected into post content unsanitized before WordPress core's `do_shortcode` filter runs, allowing an unauthenticated attacker to inject a nested `[my_calendar above=...]` shortcode; `mc_generate_calendar_nav()` then splits the `above` attribute on commas and dispatches each element via `call_user_func()` with no authentication, authorization, or callable allowlist check. This makes it possible for unauthenticated

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-104798
  • NVD CVE API 2.0

    CVE-2026-111444 · CVSS 9.8

    Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application supplies request data to inline-literal paths. These include opt-in parameterize=false queries and IN lists, and positions in developer-written where strings that the parser does not bind, such as BETWEEN bounds, function arguments and LIKE ESCAPE literals. Doubling single quotes without accounting for backslash escapes allows a value to alter the query. Bound paths are not affected; whereBetween() is bound from 4.1.2. This is fixed in 4.2.0.

    Fix: 1 public exploit Fix panel

    detailsCVE-2026-111444
  • NVD CVE API 2.0

    CVE-2026-111356 · CVSS 9.1

    MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to take over member accounts. Attackers knowing a victim's email or phone can request a code and brute-force findpass_reset to overwrite the member's password.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111356
  • NVD CVE API 2.0

    CVE-2026-111329 · CVSS 9.3

    JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant applications and app secrets.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111329
  • NVD CVE API 2.0

    CVE-2026-111322 · CVSS 9.3

    Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agent, which runs with bypassPermissions, to execute commands on the host as the Archon user.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111322
  • NVD CVE API 2.0

    CVE-2026-111312 · CVSS 9.2

    OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111312
  • NVD CVE API 2.0

    CVE-2026-111283 · CVSS 9.5

    BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.

    Fix: 1 public exploit Fix panel

    detailsCVE-2026-111283
  • NVD CVE API 2.0

    CVE-2026-111281 · CVSS 9.3

    Jooan JA-A12 IP cameras with firmware 009_20171107 and 05.02.31.105 contain a remote code execution vulnerability that allows unauthenticated attackers to run root commands via hard-coded credentials. Attackers send singleCMD=SetDiagMode to /goform/SingleHandlebyCommand with an attacker-chosen authserverip and authcode, making the jooandiag daemon execute their commands through /bin/sh, giving full device control.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-111281
  • NVD CVE API 2.0

    CVE-2026-105039 · CVSS 9.6

    EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-105039
  • NVD CVE API 2.0

    CVE-2026-105038 · CVSS 9.8

    The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication. An unauthenticated remote attacker can change AI model configuration and switch the model in use at runtime.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-105038
  • NVD CVE API 2.0

    CVE-2026-105037 · CVSS 9.9

    EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary files from the server by supplying an attacker-controlled file path. This exposes middleware files and server secrets.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-105037
  • NVD CVE API 2.0

    CVE-2026-105032 · CVSS 9.1

    The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authentication and does not constrain uploaded file paths. An unauthenticated remote attacker can use path traversal to write arbitrary files, and thereby tamper with AI skill files used by Eilik and EilikO robots.

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-105032
  • NVD CVE API 2.0

    CVE-2026-57496 · CVSS 9.6

    NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which the response is serialized through _wrap_json instead of _wrap_json_token_read, byp

    Fix: Nothing published yet: no patch, advisory or mitigation reference, no vendor advisory on the Wire, no KEV action. Fix panel

    detailsCVE-2026-57496

Older