CVE Vulnerability Catalog

The affected products are vulnerable to a command injection attack that could allow an unauthenticated attacker to execute system commands during the pairing process.

The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictable source. An unauthenticated attacker with adjacent network access and knowledge that an active session exists could potentially determine a valid session identifier and use it to bypass intended authorization controls.

The Botslab G980H dash camera firmware contains an authorization vulnerability in its session based command functionality. The product does not sufficiently associate an authenticated session with the client connection that established it, and subsequent privileged operations rely on possession of a valid session identifier without adequately validating the requesting client's authenticated context. An unauthenticated attacker with adjacent network access could potentially use valid session state associated with another client to access privileged functionality.

The Botslab G980H dash camera firmware contains a session management vulnerability in which authentication state can remain valid after the associated client connection has been terminated or replaced. Under certain connection conditions, a newly established connection can displace an existing client while previously established session state remains active until a separate expiration mechanism invalidates it. An unauthenticated attacker with adjacent network access could potentially take advantage of this residual authentication state to access functionality associated with another client's session.

Improper handling of sensitive data during IPsec policy creation and modification in Brocade SANnav versions before 3.0.1a results in pre-shared keys being recorded in application logs. Individuals with read access to system log files or support bundles can view these credentials, leading to the potential exposure of keys used to secure network tunnels.

Dell Trusted Device Client, versions prior to 8.1.359.0, contain an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information tampering.

The Botslab G980H dash camera firmware accepts a reusable authentication value without adequately verifying its freshness or association with the requesting client. An unauthenticated attacker with adjacent network access who captures a valid authentication value could replay it from another client to establish an authenticated session and access privileged device functionality.

An integer overflow exists in the BSON document encoding component of the MongoDB Python Driver's bundled native extension when a document is built from an unusually large amount of caller-supplied data. Size arithmetic uses a signed 32-bit type and the overflow guard has undefined behavior under the C standard. Depending on how the native extension was built, this can cause an out-of-bounds write within the application's own process.

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 invoked the `code` command without a fully qualified path from a SYSTEM process, resolving it against the machine PATH. The issue was resolved in assessment content version 0.0.269.0, released September 15, 2026, and remediation was deployed automatically.

ServiceNow has remediated an authorization bypass issue in the ServiceNow AI Platform. If exploited, it could enable an unauthenticated user to access data within the platform that they are not entitled to access, potentially enabling further unintended access. ServiceNow deployed the update to hosted instances and provided it to partners and self-hosted customers.

ServiceNow has remediated an improper access control issue in the ServiceNow AI Platform. This issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNow deployed the update to hosted instances and provided it to partners and self-hosted customers.

ServiceNow has remediated an authorization bypass issue in the ServiceNow AI Platform. If exploited, it could enable an authenticated user to access data within the platform that they are not entitled to access, potentially enabling further unintended access. ServiceNow deployed the update to hosted instances and provided it to partners and self-hosted customers.

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage the exposed authentication details to compromise managed network infrastructure and access active application sessions. This affects Brocade SANnav versions before 3.0.1a.

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an improper certificate validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to protection mechanism bypass and unauthorized access.

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contains an improper authorization vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains a missing authentication for critical function vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

TREK, a collaborative travel planner, prior to 3.3.0 allows an authenticated user to store an attacker-controlled llm_base_url through the settings API when the LLM_PARSING feature is enabled. The value is consumed by clients without applying the server-side request forgery guard, so triggering AI-assisted trip parsing causes the server to request the supplied destination, with upstream error text returned in parsing warnings. This permits internal service discovery and access to link-local cloud metadata, with possible disclosure of infrastructure credentials and subsequent modification of protected cloud resources. The issue is fixed in version 3.3.0.

TREK, a collaborative travel planner, prior to 3.3.0 contains an authorization flaw in the DELETE /api/trips/:tripId/collab/notes/:noteId/files/:fileId endpoint. The authenticated user is authorized against the attacker-controlled tripId, but deleteNoteFile in the server resolves the target only by note and file identifiers without requiring the file to belong to that trip. A user with edit access to any trip can submit identifiers belonging to another user's trip and permanently delete that note-file attachment.

code16 Sharp, a Laravel-based framework for building content-management and administrative interfaces, prior to 9.22.5 contains a stored cross-site scripting vulnerability in SharpEditorFormField. Attacker-controlled content bearing the data-html-content attribute can bypass HTML sanitization and preserve executable markup, which may execute when another user views the stored content. Version 9.22.5 is identified as patched.

code16 Sharp, a Laravel-based framework for building content-management and administrative interfaces, prior to 9.22.5 contains a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup inside srcdoc is HTML-encoded during sanitization, browsers decode attribute entities before interpreting the iframe document, allowing an authenticated user with permission to edit an Editor field to store executable JavaScript that runs when another user views the content. Version 9.22.5 removes srcdoc from permitted iframe attributes.