CVE Vulnerability Catalog

mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions.

mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSocket, and Node-RED, fully exposed on the LAN without access control. Any client on the same network can reach every service.

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated LAN attacker can query these endpoints, access system information, and send raw control commands to manipulate building automation devices.

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception.

The mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH daemon allows root login via key authentication and starts automatically. An attacker with the matching private key can gain a root shell on any affected device, resulting in full system compromise. The key cannot be removed without remounting the file system and survives a factory reset. Vendor notes that this functionality was used only for service purposes. This issue was fixed in version 3.0.30.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform through 2026-09-28.

Authorization bypass through User-Controlled key vulnerability in Enocta Platform by Enocta Educational Technologies Inc. Allows exploitation of trusted identifiers. The issue affects versions through 2026-09-28.

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities, including forcing the router to issue GET requests to arbitrarily chosen domains.

The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthenticated remote attacker to trigger a configuration backup and retrieve it in a form encrypted by a device-specific key. Triggering this function renders the router inoperable for a substantial period of time. This issue was identified in firmware versions up to 4.2.17. Status of newer versions remains unknown.

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross-domain authenticated request. This can lead to unauthorized access to protected resources in the context of a logged-in user.

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to insufficient access control in the HA failover endpoint. This allows destructive PostgreSQL database operations.

Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). An authenticated federation peer can send a FEDERATION_DOWNSTREAM_CONNECT packet with a crafted class name, causing the broker to load and instantiate arbitrary classes visible to the Artemis module classloader.

A weakness has been identified in dbgate up to 7.3.1 in the exportModelSql function of packages/api/src/controllers/databaseConnections.js (Export Handler component). Manipulating the outputFile argument leads to path traversal, and the attack can be executed remotely. The exploit has been made publicly available and could be used for attacks.

A security flaw has been discovered in dbgate up to 7.3.1 in the zipJsonLinesData function of packages/api/src/utility/zipJsonLinesData.js (Create Connection Endpoint component). Manipulating the filePath argument results in path traversal, and remote exploitation is possible. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in dbgate up to 6.8.1/7.0.2/7.1.8/7.2.5/7.3.1 affecting the saveUploadedFile function in files.js of the save-uploaded-file Endpoint component. Manipulation of the filePath/fileName argument leads to path traversal.

A vulnerability was determined in dbgate up to 7.3.1 affecting the createLink function in packages/api/src/controllers/archive.js of the Archive Link Creation component. Manipulation of the linkedFolder argument causes path traversal.

A security flaw has been discovered in Thinkware U3000 up to 1.02.04 in the GET_STATUS function of the TCP Service component. Manipulating the wifi_info argument results in information disclosure, and the attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

The elixir-mint library has an Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) vulnerability. A malicious HTTP/1 server can desynchronize an intermediary and the Mint client on a pooled connection, poisoning responses to subsequent requests that share the connection.

A vulnerability in the mint library (Elixir) allows a malicious HTTP/2 server to make the client buffer up to about 16 MiB per connection in frames it should reject, consuming client memory. This occurs because the frame is compared with the maximum size only after the entire declared payload has arrived, leading to excessive memory usage.