CVE Vulnerability Catalog

mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessible without authentication. An unauthenticated LAN attacker can query these endpoints, access system information, and send raw control commands to manipulate building automation devices.

mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential interception.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows XSS Targeting HTML Attributes. This issue affects Enocta Platform through 2026-09-28.

Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, allowing an MCP client or agent to replay a token generated for one resource to affect another resource of the same type. This issue is fixed in version 0.7.2.

The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This allows a remote attacker to obtain a valid session identifier without providing credentials, resulting in an authentication bypass. With this access, the attacker can perform unauthorized actions on upgrade-related functionalities, including forcing the router to issue GET requests to arbitrarily chosen domains.

An Origin Validation Error in the middleware of the connect-xcors npm package allows an attacker to bypass origin verification and perform a cross-domain authenticated request. This can lead to unauthorized access to protected resources in the context of a logged-in user.

A weakness has been identified in dbgate up to 7.3.1 in the exportModelSql function of packages/api/src/controllers/databaseConnections.js (Export Handler component). Manipulating the outputFile argument leads to path traversal, and the attack can be executed remotely. The exploit has been made publicly available and could be used for attacks.

A security flaw has been discovered in dbgate up to 7.3.1 in the zipJsonLinesData function of packages/api/src/utility/zipJsonLinesData.js (Create Connection Endpoint component). Manipulating the filePath argument results in path traversal, and remote exploitation is possible. The exploit has been released to the public and may be used for attacks.

A security flaw has been discovered in Thinkware U3000 up to 1.02.04 in the GET_STATUS function of the TCP Service component. Manipulating the wifi_info argument results in information disclosure, and the attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

The elixir-mint library has an Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling) vulnerability. A malicious HTTP/1 server can desynchronize an intermediary and the Mint client on a pooled connection, poisoning responses to subsequent requests that share the connection.

A vulnerability in the mint library (Elixir) allows a malicious HTTP/2 server to make the client buffer up to about 16 MiB per connection in frames it should reject, consuming client memory. This occurs because the frame is compared with the maximum size only after the entire declared payload has arrived, leading to excessive memory usage.

A cross-site scripting (XSS) vulnerability in Agentis by Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. is caused by improper neutralization of input during web page generation. It allows XSS targeting HTML attributes.

A path traversal vulnerability was discovered in the Kubernetes kubectl client's kubectl cp command on Windows. When copying files from a container, kubectl runs tar inside the container, transfers the archive, and unpacks it locally; a malicious tar can execute arbitrary code and write files to arbitrary paths on the user's machine.

A vulnerability was identified in Thinkware U3000 up to 1.02.04 in the get_file function of /tmp/wpa_supplicant.conf in the TCP Service component. The manipulation leads to improper access controls, and remote exploitation is possible. The exploit is publicly available and might be used.

A security flaw has been discovered in Ricoh SP 330DN, SP 221, SP C252SF and Aficio SP 3500SF up to 20260813, affecting the HTTP Multipart Form-Data Parser component. Performing a manipulation results in denial of service, and the attack can be carried out remotely. The exploit has been released publicly.

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=com_virtuemart&page=admin.user_list'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.

Stored Cross-Site Scripting (XSS) in TPVEnlanube affecting the parameter 'vendor_store_name' in the endpoint '/administrator/index.php?pshop_mode=admin&page=store.store_add&option=com_virtuemart&vendor_id=[ID]'. Successful exploitation could allow an authenticated attacker to inject malicious code and execute it in users' browsers without their consent.

A vulnerability in FLB-Music-Player 1.1.8/1.1.9/1.2.0/1.2.1 affects the path.join function in /src/main/core/createParsedTrack.ts. Manipulation leads to path traversal. The attack must be carried out locally, and the exploit has been publicly disclosed.

A flaw in UERANSIM up to 3.3.0 affects the DecodePlainMmMessage function in the library src/lib/nas/encode.cpp of the nr-gnb component. Executing a manipulation leads to an uncaught exception. The attack can be launched remotely, and the exploit has been published.