Export limit exceeded: 376127 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (376127 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2025-13293 | 1 Tbea | 1 Tbea Tlogger | 2026-08-11 | N/A |
| A hard-coded or default root account credential in TBEA TLogger V2.1.0.0B0.0.0.0 allows an unauthenticated remote attacker to obtain root-level access to the device via the exposed SSH service. The root password can be recovered from the password hash stored in /etc/shadow and used to authenticate to the SSH service. Successful exploitation provides full administrative control of the affected device. | ||||
| CVE-2025-13294 | 1 Tbea | 1 Tbea Tlogger | 2026-08-11 | N/A |
| An unauthenticated SQL injection vulnerability exists in the web server of TBEA TLogger V2.1.0.0B0.0.0.0. Multiple HTTP endpoints incorporate attacker-controlled parameters directly into SQLite queries without sufficient validation or parameterization. A remote unauthenticated attacker can exploit these endpoints to read, modify, or delete data stored in the device's CCU.db database. | ||||
| CVE-2025-15680 | 1 Tbea | 1 Tbea Tlogger | 2026-08-11 | N/A |
| TBEA TLogger V2.1.0.0B0.0.0.0 exposes a UART interface on the device's circuit board without sufficient protection. A physically proximate attacker can connect to the UART interface and observe the device boot process and runtime debug output. The disclosed information includes operating system details, software versions, network configuration, filesystem paths, and other implementation and debugging information that may assist an attacker in further compromising the device. | ||||
| CVE-2025-15681 | 1 Tbea | 1 Tbea Tlogger | 2026-08-11 | N/A |
| TBEA TLogger V2.1.0.0B0.0.0.0 contains an authentication bypass in its web server. After a user has previously authenticated to the device, an unauthenticated attacker can directly access protected functionality through the /index.asp endpoint without providing valid credentials. This allows the attacker to access functionality intended for authenticated users and may expose or modify device configuration and data. Logging out from the bypassed state can additionally cause the web server to crash. | ||||
| CVE-2025-15682 | 1 Tbea | 1 Tbea Tlogger | 2026-08-11 | N/A |
| TBEA TLogger V2.1.0.0B0.0.0.0 contains an unauthenticated resource exhaustion vulnerability in its web server. An unauthenticated remote attacker can send PUT requests to the /tmp/ endpoint, causing the web server to create persistent files containing attacker-controlled data under /opt/myapp/webserver/. The generated files are not removed because the web server attempts to move them into a non-existent directory. Repeated requests can therefore exhaust available storage and cause a denial-of-service condition. | ||||
| CVE-2025-15683 | 1 Tbea | 1 Tbea Tlogger | 2026-08-11 | N/A |
| TBEA TLogger V2.1.0.0B0.0.0.0 contains multiple unauthenticated denial-of-service vulnerabilities in its web server. An unauthenticated remote attacker can invoke specific HTTP endpoints to reboot or reset the device, clear application data, or terminate the web server through a segmentation fault. In addition, multiple action endpoints process attacker-controlled parameters using unsafe string operations such as sprintf() and strcat() without adequate bounds checking, allowing crafted input to trigger buffer overflows and crash the web server. The affected endpoints include onRestart, onReset, ClearData, uploadInvFile, getIndiaRPData, YearCaparity, TotalfaultData, recordData, InvHistoryData, CollectHistoryData, InvFaultData, GetPortTableByParm, and UpdatePortConfig. | ||||
| CVE-2025-30240 | 1 Tp-link | 33 Eb810v(eu1) V1.0, Ex220(br) V1.0/1.20/1.28/1.29/1.8, Ex220(br) V2.0 and 30 more | 2026-08-11 | N/A |
| The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem. | ||||
| CVE-2025-30241 | 1 Tp-link | 31 Eb210 Pro(eu1) 1.0, Eb210 Pro(us1) 1.0, Eb810v(eu1) V1.0 and 28 more | 2026-08-11 | N/A |
| Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise. | ||||
| CVE-2026-19424 | 1 Inventec Appliances | 1 Chiline Cloud | 2026-08-11 | 7.5 High |
| Chiline Cloud developed by Inventec Appliances has a Insecure Direct Object Reference vulnerability. Unauthenticated remote attackers can modify a specific parameter to read other users' sensitive data. | ||||
| CVE-2026-24329 | 1 Redhat | 9 Fuse 7, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 6 more | 2026-08-11 | 4.9 Medium |
| A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service. | ||||
| CVE-2026-19425 | 1 Win Men Intermational | 1 Travel Agency Management System | 2026-08-11 | 9.8 Critical |
| Travel Agency Management System developed by Win Men Intermational has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. | ||||
| CVE-2026-8158 | 1 Axis Communications Ab | 3 Axis File Player, Signed Media Verifier, Signed Video Framework | 2026-08-11 | 5.3 Medium |
| The Signed Video Framework contained a buffer overflow issue which could lead the application using this framework to crash. The issue exclusively affects the tools used for the validation of signed content. The AXIS OS device's signed video functionality remains unaffected. | ||||
| CVE-2026-14548 | 2 Lingotek-translation, Wordpress | 2 Ray Enterprise Translation, Wordpress | 2026-08-11 | N/A |
| The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to overwrite the administrator-configured translation API token with an arbitrary value. | ||||
| CVE-2026-14549 | 2 Lingotek-translation, Wordpress | 2 Ray Enterprise Translation, Wordpress | 2026-08-11 | N/A |
| The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenticated user, including Subscribers, to add or delete the site's configured languages. | ||||
| CVE-2026-19391 | 1 Redhat | 5 Certification For Red Hat Enterprise Linux, Certifications, Enterprise Linux and 2 more | 2026-08-11 | 6.5 Medium |
| A flaw was found in insights-core where the password redaction layer fails to recognize credentials not keyed under the literal string 'password'. This allows SSSD LDAP bind passwords (ldap_default_authtok) and Pacemaker fence device credentials to be included in cleartext in archives uploaded to console.redhat.com. | ||||
| CVE-2026-72694 | 2 Mrtgconfig, Redhat | 2 Mrtg, Enterprise Linux | 2026-08-11 | 7.1 High |
| A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensitive files. | ||||
| CVE-2026-15567 | 1 Redhat | 7 Fuse, Jboss Enterprise Application Platform, Jboss Enterprise Application Platform Expansion Pack and 4 more | 2026-08-11 | 7.5 High |
| A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size. | ||||
| CVE-2026-71218 | 2 Iperf3 Project, Redhat | 2 Iperf3, Enterprise Linux | 2026-08-11 | 5.3 Medium |
| A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service. | ||||
| CVE-2026-6181 | 1 Axis Communications Ab | 1 Axis Os | 2026-08-11 | 5.9 Medium |
| The Device Configuration Framework is vulnerable to an authentication bypass flaw. This flaw can only be exploited after authenticating with a viewer-privileged service account. | ||||
| CVE-2026-5303 | 1 Axis Communications Ab | 1 Axis Os | 2026-08-11 | 5.7 Medium |
| The ACAP framework contains a Time-of-Check to Time-of-Use (TOCTOU) race condition, which could potentially lead to privilege escalation. This vulnerability can only be exploited if the Axis device is configured to allow the installation of unsigned ACAP applications, and if an attacker convinces the victim to install a malicious ACAP application. | ||||