Search vulnerabilities

Expected end of text, found '/' (at char 27), (line:1, col:28)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,942

CVE-2026-87118

Botslab G980H Dashcams Out-of-bounds Write

The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticated attacker with adjacent network access could submit crafted command data that corrupts memory, potentially disrupting authentication state or causing the affected process to terminate and the device to restart, resulting in a temporary denial of service.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-85496

Botslab G980H Dashcams Generation of Predictable Numbers or Identifiers

The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session identifier and use it to bypass intended authorization controls.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-85082

Maple Media Root Browser Classic 3.3.0 - OS command injection through crafted SQLite filenames

Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename from the command.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
Maple Media
Products
Root Browser Classic
CVE-2026-84403

Botslab G980H Dashcams Missing Authentication for Critical Function

The Botslab G980H dash camera firmware does not require authenticated pairing or client binding before permitting access to Bluetooth Low Energy communications and GATT characteristics. An unauthenticated attacker within Bluetooth range could intercept or directly retrieve sensitive device information, including device identifiers, firmware information, and protected WiFi credentials.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-84283

FluteCode Secure Folder 1.2 -Plaintext vault files in shared storage bypass the PIN gate

Secure Folder 1.2 stores files selected for its password-protected vault as unencrypted files in the Android shared-storage tree. A local application or file manager that has access to the relevant shared-storage path can enumerate, copy, and open those files without authenticating to Secure Folder.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Flutecode
Products
Secure Folder
CVE-2026-82716

Botslab G980H Dashcams Insertion of Sensitive Information into Log File

The Botslab G980H dash camera firmware includes sensitive configuration information, including WiFi credentials, in diagnostic logs generated during the support process. These logs remain accessible on removable storage after the support operation has completed. An unauthenticated attacker with physical access to the storage media could retrieve the logs and obtain sensitive device information.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-82708

Botslab G980H Dashcams Improper Limitation of a Pathname to a Restricted Directory

The Botslab G980H dash camera firmware contains a path traversal vulnerability in its HTTP server. An attacker with access to the device's WiFi network could submit a crafted request to access files within the device's removable storage that were not intended to be directly accessible through the web server. Exposed files could include recordings, images, diagnostic logs, or firmware files.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-82585

Botslab G980H Dashcams Cleartext Transmission of Sensitive Information

The Botslab G980H dash camera firmware transmits sensitive information over unencrypted HTTP and RTSP connections. An attacker capable of intercepting communications on the device's WiFi network could obtain stored recordings, live video, location information, images, diagnostic logs, or other sensitive information exchanged between the device and its mobile application.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-81630

Botslab G980H Dashcams Insufficient Verification of Data Authenticity

The Botslab G980H dash camera firmware does not adequately verify the authenticity of firmware updates. The update process retrieves firmware through an unprotected connection and relies on an integrity value supplied with the firmware instead of a trusted cryptographic signature. A suitably positioned attacker who intercepts a firmware download, or an authenticated attacker who submits a crafted update, could install modified firmware and execute unauthorized code on the device.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-79959

Botslab G980H Dashcams Use of Hard-coded Credentials

The Botslab G980H dash camera firmware contains a hard-coded root account password that cannot be changed by the user. An attacker who obtains the firmware or has physical access to the device could recover the credential and use it to obtain root access through the UART interface.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-77967

Botslab G980H Dashcams Authentication Bypass by Capture-replay

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an authenticated session and access privileged device functionality.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-75558

Botslab G980H Dashcams Use of Hard-coded Cryptographic Key

The Botslab G980H dash camera firmware uses a hard-coded cryptographic key and initialization vector to protect WiFi credentials communicated by the device. An attacker who obtains the protected credential and extracts the cryptographic material from the firmware could recover the WiFi password and gain unauthorized access to the device network.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Botslab
Products
G980h
CVE-2026-61714

FluidSynth: Heap Buffer Overflow in MIDI Player

FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.2.4 until 2.5.6, configuring synth.midi-channels above 16 allows the MIDI player to index _fluid_player_t::channel_isplaying outside its fixed-size heap allocation while tracking active channels. The resulting out-of-bounds reads and writes invoke undefined behavior and may compromise confidentiality, integrity, or availability. No crafted MIDI file is required because the unsafe condition is created by the channel-count configuration itself. Keeping synth.midi-channels at its default value of 16 avoids the vulnerable path. This issue is fixed in version 2.5.6.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Fluidsynth
Products
Fluidsynth
CVE-2026-14443

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential compromise of encrypted network tunnels.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Brocade
Products
Sannav
CVE-2026-14441

Logic flaw in SANnav Java cache key handling object comparison handling

A logic flaw in Java cache key handling object comparison handling could lead to improper identifier resolution when processing specific user account structures. The issue has been remediated by updating the internal comparison routines to ensure accurate object evaluation and prevent potential identity mismatch conditions.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Brocade
Products
Sannav
CVE-2026-34689

Adobe Connect | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

Adobe Connect is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation of this issue does not require user interaction. Scope is changed.

CVSS 3.1 · 8.6 High EPSS 1.0% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Adobe Connect Adobe Connect Android Mobile App Connect and 3 more
CVE-2026-48361

Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Adobe Apple Microsoft
Products
Adobe Connect Adobe Connect Android Mobile App Connect and 3 more
CVE-2026-24239

Remote Code Execution via Malicious Data in NVIDIA NeMo Speech

NVIDIA NeMo Speech for all platforms contains a vulnerability where malicious data created by an attacker could cause remote code execution. A successful exploit of this vulnerability might lead to code execution, information disclosure, and data tampering.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Nvidia
Products
Nemo Speech
CVE-2026-67279

SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS

RouterOS SSH enters the connection protocol after a client-requested rekey even though user authentication was never attempted, allowing an unauthenticated client to open a session channel and send an exec request. On affected builds the server dispatches the command, enabling unauthenticated creation, overwrite, and reconstruction of files in the RouterOS managed file namespace, including support files containing configuration and diagnostic data.This issue was fixed in versions: 6.49.21 (Long-term), 7.23.4 (Long-term) and 7.24.2 (Stable)

CVSS 4.0 · 6.9 Medium EPSS 2.3% KEV · Listed
Vendors
Mikrotik
Products
Routeros