CVE-2012-6440

Rockwell Automation ControlLogix PLC Improper Input Validation

The Web server password authentication mechanism used by the products is vulnerable to a MitM and Replay attack. Successful exploitation of this vulnerability will allow unauthorized access of the product’s Web server to view and alter product configuration and diagnostics information. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

CVSS 3.1 · 4.8 Medium EPSS 9.2% KEV · Not listed

Vendors

Rockwellautomation

Products

1756-enbt 1756-eweb 1768-enbt and 14 more

CVE-2012-6438

Rockwell Automation ControlLogix PLC Improper Input Validation

The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the NIC to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

CVSS 3.1 · 7.5 High EPSS 35.5% KEV · Not listed

Vendors

Rockwellautomation

Products

1756-enbt 1756-eweb 1768-enbt and 14 more

CVE-2012-6437

Rockwell Automation ControlLogix PLC Improper Authentication

The device does not properly authenticate users and the potential exists for a remote user to upload a new firmware image to the Ethernet card, whether it is a corrupt or legitimate firmware image. Successful exploitation of this vulnerability could cause loss of availability, integrity, and confidentiality and a disruption in communications with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

CVSS 3.1 · 9.8 Critical EPSS 10.5% KEV · Not listed

Vendors

Rockwellautomation

Products

1756-enbt 1756-eweb 1768-enbt and 14 more

CVE-2012-6436

Rockwell Automation ControlLogix PLC Improper Input Validation

The device does not properly validate the data being sent to the buffer. An attacker can send a malformed CIP packet to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP, which creates a buffer overflow and causes the CPU to crash. Successful exploitation of this vulnerability could cause loss of availability and a disruption in communications with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

CVSS 3.1 · 7.5 High EPSS 35.2% KEV · Not listed

Vendors

Rockwellautomation

Products

1756-enbt 1756-eweb 1768-enbt and 14 more

CVE-2012-6435

Rockwell Automation ControlLogix PLC Improper Access Control

When an affected product receives a valid CIP message from an unauthorized or unintended source to Port 2222/TCP, Port 2222/UDP, Port 44818/TCP, or Port 44818/UDP that instructs the CPU to stop logic execution and enter a fault state, a DoS can occur. This situation could cause loss of availability and a disruption of communication with other connected devices. Rockwell Automation EtherNet/IP products; 1756-ENBT, 1756-EWEB, 1768-ENBT, and 1768-EWEB communication modules; CompactLogix L32E and L35E controllers; 1788-ENBT FLEXLogix adapter; 1794-AENTR FLEX I/O EtherNet/IP adapter; ControlLogix 18 and earlier; CompactLogix 18 and earlier; GuardLogix 18 and earlier; SoftLogix 18 and earlier; CompactLogix controllers 19 and earlier; SoftLogix controllers 19 and earlier; ControlLogix controllers 20 and earlier; GuardLogix controllers 20 and earlier; and MicroLogix 1100 and 1400

CVSS 3.1 · 7.5 High EPSS 42.8% KEV · Not listed

Vendors

Rockwellautomation

Products

1756-enbt 1756-eweb 1768-enbt and 14 more

CVE-2024-3305

IDOR in Utarit Information's SoliClub

Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in Utarit Information SoliClub allows Retrieve Embedded Sensitive Data. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Utarit

Products

Soliclub

CVE-2024-3306

IDOR in Utarit Information's SoliClub

Authorization Bypass Through User-Controlled Key vulnerability in Utarit Information SoliClub allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SoliClub: before 4.4.0 for iOS, before 5.2.1 for Android.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Utarit

Products

Soliclub

CVE-2025-15656

WordPress School Management plugin <= 93.2.0 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through 93.2.0.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mojoomla Wordpress

Products

School Management Wordpress

CVE-2024-3370

SQLi in Egebilgi Software's Website Template

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Egebilgi Software Website Template allows SQL Injection. This issue affects Website Template: before 29.04.2024.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Egeabilgi Software

Products

Website Template

CVE-2024-3373

SQLi in RSM Design's Website Template

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RSM Design Website Template allows SQL Injection. This issue affects Website Template: before 1.2.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Rsm Design

Products

Web Template

CVE-2026-10705

dask HLL hyperloglog.py nunique_approx resource consumption

A flaw has been found in dask up to 3.0. Affected by this issue is the function nunique_approx of the file dask/dataframe/hyperloglog.py of the component HLL Handler. This manipulation causes resource consumption. The attack is possible to be carried out remotely. A high degree of complexity is needed for the attack. The exploitation is known to be difficult. The pull request to fix this issue awaits acceptance.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Dask

Products

Dask

CVE-2024-3375

Broken Access Control in Havelsan's Dialogue

Incorrect Permission Assignment for Critical Resource vulnerability in Havelsan Inc. Dialogue allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Dialogue: from v1.83 before v1.83.1 or v1.84.

CVSS 3.1 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

Havelsan

Products

Dialogue

CVE-2026-10692

johnhuang316 code-index-mcp search_code_advanced is_safe_regex_pattern redos

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function is_safe_regex_pattern of the component search_code_advanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. Upgrading to version 2.14.1 is able to address this issue. This patch is called 25bc02fac74051ddae15ce79e952f00211b1ea6b. Upgrading the affected component is recommended.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Johnhuang316

Products

Code-index-mcp

CVE-2026-45609

mcp-security: Unvalidated URL Fetching (SSRF)

mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol (MCP) security specifications. Specifically, it processes untrusted URLs for OAuth-related discovery and metadata without verifying if the targets are malicious or internal to the network. This only affects installations with Dynamic Client Registration (DCR) enabled This vulnerability is fixed in 0.1.9.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Spring-ai-community Springaicommunity

Products

Mcp-security Mcp Security

CVE-2024-4259

Sensetive Data Exposure in SAMPAS's AKOS

Missing Authorization vulnerability in SAMPAŞ Holding AKOS (AkosCepVatandasService), SAMPAŞ Holding AKOS (TahsilatService) allows Collect Data as Provided by Users. This issue affects AKOS (AkosCepVatandasService): before V2.0; AKOS (TahsilatService): before V1.0.7.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Sambas Sampas Holding

Products

Akos Akos

CVE-2026-35466

Stored XSS via unsanitized input from remote service

XSS vulnerability in cveInterface.js allows for inject HTML to be passed to display, as cveInterface trusts input from CVE API services

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cert/cc Cmu

Products

Cveclient/cveinterface.js Cveclient

CVE-2024-4341

IDOR in ExtremePacs's Extreme XDS

Authorization Bypass Through User-Controlled Key, Missing Authorization vulnerability in ExtremePacs Extreme XDS allows Collect Data as Provided by Users. This issue affects Extreme XDS: before 3928.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Extremepacs

Products

Extreme Xds

CVE-2024-4428

Sensetive Data Exposure in Menulux Managment Portal

Missing Authentication for Critical Function, Missing Authorization vulnerability in Menulux Information Technologies Managment Portal allows Collect Data as Provided by Users. This issue affects Managment Portal: through 21.05.2024.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Menulux

Products

Management Portal Managment Portal

CVE-2026-42504

Quadratic complexity in WordDecoder.DecodeHeader in mime

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Golang

Products

Mime

CVE-2026-35467

Private Key stored as extractable in browser IndexeDB

The stored API keys in temporary browser client is not marked as protected allowing for JavScript console or other errors to allow for extraction of the encryption credentials.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Cert/cc Cmu

Products

Cveclient/encrypt-storage.js Cveclient