CVE-2026-102507

Sliver 1.7.7 Denial of Service via PE Parser Slice Bounds in Operator RPC

Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker controlling a compromised implant to crash the entire teamserver by returning a malformed or empty Download response. Attackers can send zero-length or 1-3 byte data payloads through a hostile implant session to trigger an out-of-bounds slice access in the vendored Binject library's BinaryMagic function, which propagates unrecovered through the operator gRPC interceptor chain and terminates the server process, affecting all connected operators.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bishopfox

Products

Sliver

CVE-2026-102253

iperf3 < 3.22 UDP Receive Worker Infinite Loop DoS

iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the server's UDP receive worker into an unrecoverable infinite loop by sending a single crafted control-channel parameter message followed by one 16-byte UDP datagram. Attackers can permanently pin the affected per-stream receive thread at approximately 100% CPU usage, rendering the server unusable until forcibly killed with SIGKILL, as the process does not respond to normal control-channel closure.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Es

Products

Iperf3

CVE-2026-101861

Langflow Code Execution via eval() in Component Input Schema

Langflow 1.0.16 before 1.12.0 and 0.0.94 before 1.12.0 contain an unsafe eval() vulnerability in schema.py that allows authenticated attackers to achieve code execution by placing a Python object with a malicious __repr__ method into component input options lists. The eval() sink is triggered when a component is converted into a LangChain tool via ComponentToolkit.get_tools(), including during custom component saves through the API, by interpolating options into a Literal type string that is passed directly to eval() without safe evaluation controls.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Langflow

Products

Langflow

CVE-2024-58304

SPA-CART CMS < 2.0.0 Stored Cross-Site Scripting

SPA-CART CMS before 2.0.0 contains a stored cross-site scripting vulnerability in the product description parameter that allows authenticated administrators to inject malicious scripts. Attackers can submit JavaScript payloads through the 'descr' parameter in the product edit form to execute arbitrary code in administrative users' browsers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Spa-cart

Products

Spa-cart Spa-cartcms

CVE-2023-7342

Belden HiSecOS Web Server Privilege Escalation

HiSecOS web server versions 03.4.00 prior to 04.1.00 contains a privilege escalation vulnerability that allows authenticated users with operator or auditor roles to escalate privileges to the administrator role by sending specially crafted packets to the web server. Attackers can exploit this flaw to gain full administrative access to the affected device.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Belden

Products

Hirschmann Hisecos

CVE-2023-54391

Proxmox VE 7.0-8.0 Authentication Bypass via tfa-challenge Parameter

Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that allows unauthenticated attackers to authenticate as any existing enabled user without a configured second factor by supplying an arbitrary tfa-challenge value in the API login endpoint. Attackers can send a POST request to the access ticket API endpoint with any value in the tfa-challenge parameter to completely skip password verification, gaining unauthorized access including to the root@pam account. All affected releases are end of life.

CVSS 4.0 · 9.3 Critical EPSS 3.0% KEV · Not listed

Vendors

Proxmox

Products

Proxmox Virtual Environment (ve) Virtual Environment

CVE-2023-53974

D-Link DSL-124 ME_1.00 Backup Configuration File Disclosure via Unauthenticated Request

D-Link DSL-124 ME_1.00 contains a configuration file disclosure vulnerability that allows unauthenticated attackers to retrieve router settings through a POST request. Attackers can send a specific POST request to the router's configuration endpoint to download a complete backup file containing sensitive network credentials and system configurations.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

D-link Dlink

Products

Dsl-124 Dsl-124 Dsl-124 Firmware

CVE-2023-53908

HiSecOS 04.0.01 Privilege Escalation via User Role Modification

HiSecOS 04.0.01 contains a privilege escalation vulnerability that allows authenticated users to modify their access role through XML-based NETCONF configuration. Attackers can send crafted XML payloads to the /mops_data endpoint with a specific role value to elevate their user privileges to administrative level.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Belden

Products

Hirschmann Hisecos Hisecos

CVE-2022-50896

Testa 3.5.1 Online Test Management System - Reflected Cross-Site Scripting (XSS)

Testa 3.5.1 contains a reflected cross-site scripting vulnerability in the login.php redirect parameter that allows attackers to inject malicious scripts. Attackers can craft a specially encoded payload in the redirect parameter to execute arbitrary JavaScript in victim's browser context.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Testa

Products

Online Test Management System

CVE-2021-47822

DiskBoss Service 12.2.18 - 'diskbsa.exe' Unquoted Service Path

DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to execute code with elevated privileges. Attackers can exploit the unquoted path by placing malicious executables in potential path locations to gain system-level access during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Diskboss Flexense

Products

Diskboss Service Diskboss

CVE-2021-47785

Ether_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH)

Ether MP3 CD Burner 1.3.8 contains a buffer overflow vulnerability in the registration name field that allows remote code execution. Attackers can craft a malicious payload to overwrite SEH handlers and execute a bind shell on port 3110 by exploiting improper input validation.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Ether Software Ethersoftware

Products

Mp3\/avi\/mpeg\/wmv\/rm To Audio Cd Burner Ether Mp3 Cd Burner

CVE-2020-37165

AbsoluteTelnet 11.12 - "license name" Denial of Service

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license name field to trigger an application crash.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Celestial Software Celestialsoftware

Products

Absolutetelnet Absolutetelnet

CVE-2020-37164

AbsoluteTelnet 11.12 - "license entry" Denial of Service

AbsoluteTelnet 11.12 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an oversized license name. Attackers can generate a 2500-character payload and paste it into the license entry field to trigger an application crash.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Celestial Software Celestialsoftware

Products

Absolutetelnet Absolutetelnet

CVE-2020-37155

Core FTP Lite 1.3 - Denial of Service (PoC)

Core FTP Lite 1.3 contains a buffer overflow vulnerability in the username input field that allows attackers to crash the application by supplying oversized input. Attackers can generate a 7000-byte payload of repeated 'A' characters to trigger an application crash without requiring additional interaction.

CVSS 4.0 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Core Ftp Coreftp

Products

Core Ftp Lite Core Ftp

CVE-2020-37070

CloudMe 1.11.2 - Buffer Overflow (SEH,DEP,ASLR)

CloudMe 1.11.2 contains a buffer overflow vulnerability that allows remote attackers to execute arbitrary code through crafted network packets. Attackers can exploit the vulnerability by sending a specially crafted payload to the CloudMe service running on port 8888, enabling remote code execution.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Cloudme

Products

Cloudme Sync

CVE-2020-36895

EIBIZ i-Media Server Digital Signage 3.8.0 Unauthenticated Configuration Disclosure

EIBIZ i-Media Server Digital Signage 3.8.0 contains an unauthenticated configuration disclosure vulnerability that allows remote attackers to access sensitive configuration files via direct object reference. Attackers can retrieve the SiteConfig.properties file through an HTTP GET request, exposing administrative credentials, database connection details, and system configuration information.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Eibiz

Products

I-media Server Digital Signage

CVE-2020-36894

Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated User Creation Vulnerability

Eibiz i-Media Server Digital Signage 3.8.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to create admin users through AMF-encoded object manipulation. Attackers can send crafted serialized objects to the /messagebroker/amf endpoint to create administrative users without authentication, bypassing security controls.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Eibiz

Products

I-media Server Digital Signage

CVE-2020-36893

Eibiz i-Media Server Digital Signage 3.8.0 Directory Traversal Vulnerability

Eibiz i-Media Server Digital Signage 3.8.0 contains a directory traversal vulnerability that allows unauthenticated remote attackers to access files outside the server's root directory. Attackers can exploit the 'oldfile' GET parameter to view sensitive configuration files like web.xml and system files such as win.ini.

CVSS 4.0 · 8.7 High EPSS 1.7% KEV · Not listed

Vendors

Eibiz Microsoft

Products

I-media Server Digital Signage Windows

CVE-2020-36892

Eibiz i-Media Server Digital Signage 3.8.0 Unauthenticated Privilege Escalation

Eibiz i-Media Server Digital Signage 3.8.0 contains an unauthenticated privilege escalation vulnerability in the updateUser object that allows attackers to modify user roles. Attackers can exploit the /messagebroker/amf endpoint to elevate privileges and take over user accounts by manipulating role settings without authentication.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Eibiz

Products

I-media Server Digital Signage

CVE-2019-25760

Joomla! Component Easy Shop 1.2.3 Local File Inclusion

Joomla! Component Easy Shop 1.2.3 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by supplying base64-encoded file paths. Attackers can send GET requests to index.php with the option parameter set to com_easyshop, task set to ajax.loadImage, and a base64-encoded file path in the file parameter to retrieve sensitive files like configuration.php and system files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Joomtech

Products

Easy Shop