CVE-2026-40434

Anviz CrossChex Standard Improper Verification of Source of a Communication Channel

Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Crosschex Standard Crosschex Standard

CVE-2026-24178

Unauthenticated Authorization Bypass via User‑Controlled Key in NVIDIA FLARE Dashboard

NVIDIA NVFlare Dashboard contains a vulnerability in the user management and authentication system where an unauthenticated attacker may cause authorization bypass through user-controlled key. A successful exploit of this vulnerability may lead to privilege escalation, data tampering, information disclosure, code execution, and denial of service.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apple Linux Nvidia

Products

Macos Linux Kernel Flare Sdk and 1 more

CVE-2026-24186

Deserialization of Untrusted Data in NVIDIA FLARE SDK FOBS Leading to Code Execution

NVIDIA FLARE SDK contains a vulnerability in FOBS, where an attacker may cause deserialization of untrusted data by sending a malicious FOBS- encoded message. A successful exploit of this vulnerability might lead to code execution.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Linux Nvidia

Products

Macos Linux Kernel Flare Sdk and 1 more

CVE-2026-24204

Improper Input Validation in NVIDIA Flare SDK Leading to Path Traversal and Information Disclosure

NVIDIA Flare SDK contains a vulnerability where an Attacker may cause an Improper Input Validation by path traversing. A successful exploit of this vulnerability may lead to information disclosure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Linux Nvidia

Products

Macos Linux Kernel Flare Sdk and 1 more

CVE-2026-34262

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Hana Cockpit Hana Database Explorer

CVE-2026-32324

Anviz CX7 Firmware Use of Hard-coded Cryptographic Key

Anviz CX7 Firmware is  vulnerable because the application embeds reusable certificate/key material, enabling decryption of MQTT traffic and potential interaction with device messaging channels at scale.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx7 Firmware Cx7 Cx7 Firmware

CVE-2026-32648

Anviz Products Missing Authorization

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in reconnaissance against the device.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx2 Lite Firmware Anviz Cx7 Firmware Cx2 Lite and 3 more

CVE-2026-33093

Anviz Products Missing Authorization

Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information about the deployment environment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx7 Firmware Cx7 Cx7 Firmware

CVE-2026-33569

Anviz Products Cleartext Transmission of Sensitive Information

Anviz CX2 Lite and CX7 administrative sessions occur over HTTP, enabling on‑path attackers to sniff credentials and session data, which can be used to compromise the device.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx2 Lite Firmware Anviz Cx7 Firmware Cx2 Lite and 3 more

CVE-2026-35061

Anviz Products Missing Authorization

Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved without authentication, revealing sensitive operational imagery.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx7 Firmware Cx7 Cx7 Firmware

CVE-2026-35546

Anviz Products Missing Authentication for Critical Function

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated firmware uploads. This causes crafted archives to be accepted, enabling attackers to plant and execute code and obtain a reverse shell.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx2 Lite Firmware Anviz Cx7 Firmware Cx2 Lite and 3 more

CVE-2026-24222

Remote Information Disclosure via Prompt Injection in NeMoClaw Sandbox Initialization

NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environment variables not properly restricted during sandbox creation. A successful exploit of this vulnerability might lead to information disclosure.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Nemoclaw

CVE-2026-35682

Anviz CX2 Lite Command Injection

Anviz CX2 Lite is vulnerable to an authenticated command injection via a filename parameter that enables arbitrary command execution (e.g., starting telnetd), resulting in root‑level access.

CVSS 3.1 · 8.8 High EPSS 1.8% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx2 Lite Firmware Cx2 Lite Cx2 Lite Firmware

CVE-2026-24231

NVIDIA NemoClaw SSRF Vulnerability via Endpoint URL

NVIDIA NemoClaw contains a vulnerability in the validateEndpointUrl() SSRF protection component, where an attacker could cause a server-side request forgery by supplying a crafted endpoint URL referencing the 0.0.0.0/8 address range through a blueprint configuration file or CLI flag. A successful exploit of this vulnerability may lead to information disclosure.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Nemoclaw

CVE-2026-40461

Anviz Products Missing Authentication for Critical Function

Anviz CX2 Lite and CX7 are vulnerable to unauthenticated POST requests that modify debug settings (e.g., enabling SSH), allowing unauthorized state changes that can facilitate later compromise.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Anviz

Products

Anviz Cx2 Lite Firmware Anviz Cx7 Firmware Cx2 Lite and 3 more

CVE-2026-1874

Denial-of-Service (DoS) vulnerability in Ethernet function of MELSEC iQ-F Series EtherNet/IP module and Ethernet module

Always-Incorrect Control Flow Implementation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-ENET/IP Ethernet Module FX5-ENET/IP versions 1.106 and prior and Mitsubishi Electric Corporation MELSEC iQ-F Series FX5-EIP EtherNet/IP Module FX5-EIP versions 1.000 and prior allows a remote attacker to cause a denial-of-service (DoS) condition on the products by continuously sending UDP packets to the products. A system reset of the product is required for recovery.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mitsubishi Electric Mitsubishielectric

Products

Melsec Iq-f Series Fx5-enet/ip Ethernet Module Fx5-enet/ip Melsec Iq-f Series Fx5-enet Ip Melsec Iq-f Fx5-eip and 3 more

CVE-2026-28402

nimiq/core-rs-albatross's nimiq-blockchain missing proposal body root verification

nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to version 1.2.2, a malicious or compromised validator that is elected as proposer can publish a macro block proposal where `header.body_root` does not match the actual macro body hash. The proposal can pass proposal verification because the macro proposal verification path validates the header but does not validate the binding `body_root == hash(body)`; later code expects this binding and may panic on mismatch, crashing validators. Note that the impact is only for validator nodes. The patch for this vulnerability is formally released as part of v1.2.2. The patch adds the corresponding body root verification in the proposal checks. No known workarounds are available.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nimiq

Products

Core-rs-albatross Nimiq Proof-of-stake

CVE-2026-5475

NASA cFS CCSDS Header Size cfe_sb_priv.c CFE_SB_TransmitMsg memory corruption

A vulnerability was determined in NASA cFS up to 7.0.0. This impacts the function CFE_SB_TransmitMsg of the file cfe_sb_priv.c of the component CCSDS Header Size Handler. Executing a manipulation can lead to memory corruption. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Nasa

Products

Cfs Core Flight System

CVE-2026-5476

NASA cFS cfe_tbl_passthru_codec.c CFE_TBL_ValidateCodecLoadSize integer overflow

A vulnerability was identified in NASA cFS up to 7.0.0 on 32-bit. Affected is the function CFE_TBL_ValidateCodecLoadSize of the file cfe/modules/tbl/fsw/src/cfe_tbl_passthru_codec.c. The manipulation leads to integer overflow. The complexity of an attack is rather high. The exploitability is told to be difficult. A fix is planned for the upcoming version milestone of the project.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Nasa

Products

Cfs Core Flight System

CVE-2026-7579

AstrBotDevs AstrBot Dashboard auth.py hard-coded credentials

A security vulnerability has been detected in AstrBotDevs AstrBot up to 4.16.0. This issue affects some unknown processing of the file astrbot/dashboard/routes/auth.py of the component Dashboard. The manipulation leads to hard-coded credentials. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Astrbot

Products

Astrbot