Search vulnerabilities

Expected end of text, found '\' (at char 30), (line:1, col:31)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,825

CVE-2026-100292

Improper neutralization of special elements used in an OS command ('OS command injection') in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing additional commands to be sent to a backend service. Once active, this pathway can unintentionally expose system‑level functionality that could be misused if crafted inputs reach the underlying command handler.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Anjvision
Products
Yssd-rtmp-h5
CVE-2026-100293

Improper verification of cryptographic signature in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic verification, relying only on basic hashing. This design allows an attacker who can reach the update routine to introduce untrusted firmware images that the device will accept as valid.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Anjvision
Products
Yssd-rtmp-h5
CVE-2026-100294

Use of Hard-coded Credentials in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devices. Anyone obtaining the public firmware package can reuse these values to interact with the cloud service in ways not intended for normal operation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Anjvision
Products
Yssd-rtmp-h5
CVE-2026-53989

Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint

Dockhand before 1.0.36 contains an open redirect vulnerability in the OIDC initiation endpoint that allows unauthenticated remote attackers to redirect authenticated users to attacker-controlled sites by injecting an unvalidated redirect query parameter. Attackers can craft a malicious link targeting the OIDC callback flow to capture authorization codes via the Referer header and conduct follow-up credential phishing against any Dockhand account after a legitimate login.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Finsys
Products
Dockhand
CVE-2026-100295

Active debug code in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing functions not intended for normal operation. When activated, this interface allows actions that could unintentionally provide elevated system access.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Anjvision
Products
Yssd-rtmp-h5
CVE-2026-100296

Improper Check for Unusual or Exceptional Conditions in Anjvision YSSD-RTMP-H5

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handler, silently downgrades the administrator password to the default value and corrupts the in-memory authentication state until the device reloads. The handler does not verify the session's privilege level, so any authenticated user can trigger it.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Anjvision
Products
Yssd-rtmp-h5
CVE-2026-100297

Server-Side request forgery (SSRF) in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from the device’s internal network. This may expose internal information or leak data via DNS queries.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Anjvision
Products
Yssd-rtmp-h5
CVE-2026-100298

Insufficiently Protected Credentials in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under conditions that are not intended for normal operation.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Anjvision
Products
Yssd-rtmp-h5
CVE-2026-100299

Use of Weak Credentials in Anjvision YSSD-RTMP-H5

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak DES‑based encryption.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Anjvision
Products
Yssd-rtmp-h5
CVE-2026-102877

Fider before 0.38.0 SSRF via DNS rebinding in webhook validation

Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhooks and custom OAuth provider endpoints. Administrators controlling DNS can perform DNS rebinding attacks to make the Fider server send requests to internal services or cloud metadata endpoints.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Getfider
Products
Fider
CVE-2026-102878

mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script execution, page content reading, and screenshot capture.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Hangwin
Products
Mcp-chrome-bridge
CVE-2026-102879

ClaraVerse through 0.3.1 SSRF Protection Bypass

ClaraVerse through 0.3.1 contains server-side request forgery protection bypasses in the download_file and scrape_web agent tools. Authenticated users can bypass hostname validation and IPv6 transition address filtering to make the server request internal services and cloud instance metadata endpoints.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Claraverse-space
Products
Claraverse
CVE-2026-94204

Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application

The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted access to all stored objects. Because this bucket serves as shared storage for the platform, sensitive user records, live dashcam footage, application packages, and firmware files are exposed to anyone on the internet.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Viidure
Products
Dashcam Android Application
CVE-2026-96587

Use of Hard-coded Credentials in Viidure Dashcam Android Application

The Viidure Android application embeds permanent, plaintext cloud storage credentials within its compiled code. These credentials provide full access to critical platform storage, including the ability to read, modify, or delete operational files such as firmware and application binaries.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Viidure
Products
Dashcam Android Application
CVE-2026-102930

virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels fetched for periodic updates or the --download option without checking their bytes against an authoritative digest equivalent to the embedded wheels' BUNDLE_SHA256 verification. A compromised index, stale mirror, or intercepted TLS connection can substitute a different wheel under the requested distribution, version, and filename, after which virtualenv caches and seeds the attacker-controlled wheel into subsequently created environments. The verification applies to the default PyPI path and is intentionally skipped when PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX configures a custom index that may legitimately publish rebuilt wheels. This issue is fixed in version 21.7.12.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Pypa Python
Products
Virtualenv Virtualenv
CVE-2026-93853

Barman snapshot backup deletion trusts unverified backup catalog metadata

Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement, Barman reads the snapshot identifiers from the backup.info file and passes them to the cloud provider's delete API using Barman's own credentials, without verifying that the snapshots belong to that backup. An attacker who can overwrite backup.info but lacks snapshot delete permissions can substitute the identifiers of other snapshots, causing Barman to delete any snapshot its cloud identity can reach on AWS, Microsoft Azure, or Google Cloud. Exploitation requires a deployment where the principal that writes the backup catalog is separate from the identity Barman uses to delete snapshots. Barman versions from 3.4.0 (Google Cloud), 3.6.0 (Azure), and 3.7.0 (AWS) up to and including 3.20.0 are affected. The issue is fixed in Barman 3.20.1.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Enterprisedb
Products
Barman
CVE-2026-102938

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata. The security impact requires prompt input from outside the operator's trust boundary; directly supplied prompt content primarily corrupts the operator's own environment. This issue is fixed in version 21.7.11.

CVSS 4.0 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Pypa Python
Products
Virtualenv Virtualenv
CVE-2026-84409

Lantronix G520 Series Cellular Gateway Cross-site Scripting

The device's update mechanism retrieves metadata for software updates over an unencrypted HTTP connection and stores portions of that metadata for later use. A management interface subsequently returns this stored value in a JSON response, and the web interface responsible for displaying update information inserts that value directly into the page as HTML. This behavior allows attacker‑controlled metadata to be interpreted as script content. In addition, the same authenticated origin provides an interface capable of executing system‑level commands with root privileges. An attacker able to influence update metadata could exploit these conditions to execute arbitrary code within the administrative context of the device.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Lantronix
Products
G520 Series
CVE-2026-91191

Lantronix G520 Series Cellular Gateway Improper Verification of Cryptographic Signature

The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed. Separately, the publicly distributed SDK contains the production private key whose corresponding public key is trusted by both stable and beta firmware builds. Either issue undermines package authenticity, and together they allow an attacker to provide packages that appear valid to the system. Even if signature enforcement is restored, the exposed production key enables an attacker to generate signatures that the device will continue to trust. An attacker who can supply a malicious package may be able to execute arbitrary code with root privileges during installation.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Lantronix
Products
G520 Series