| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-121928 | 4.0 | A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_utils.py of the component Images API. The manipulation leads to cross site scripting. It is possible to initiate | 2026-11-09 17:17:18 | 2026-11-04 19:17:32 |
| CVE-2026-121690 | - | FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privileges. All processes run as root and the system lacks privilege separation. The compromise of any single service results in full administrative cont | 2026-11-09 17:17:17 | 2026-11-09 17:17:17 |
| CVE-2026-121689 | - | FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure mechanisms. The Wi‑Fi PSK is stored in plaintext in wpa_supplicant.conf and is disclosed through unauthenticated API endpoints and diag | 2026-11-09 17:17:17 | 2026-11-09 17:17:17 |
| CVE-2026-121688 | - | FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanism. The STM32 motor‑controller firmware is fetched over unencrypted HTTP. Integrity is validated only via MD5, with the hash provided | 2026-11-09 17:17:17 | 2026-11-09 17:17:17 |
| CVE-2026-121927 | 6.5 | A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.3. Affected by this issue is the function _account_get of the file common/data_source/seafile_connector.py of the component Seafile Connector. Such manipulation of the argument seafile_u | 2026-11-09 17:17:17 | 2026-11-04 18:17:42 |
| CVE-2026-121926 | 7.5 | A vulnerability was detected in yezhihao jt808-server up to a07f68c466b560b97ef41edb8a4966469abdf83e. Affected is the function WebMvcConfig.addInterceptors of the component Web Management API. The manipulation results in missing authentication. The a | 2026-11-09 17:17:17 | 2026-11-04 17:17:35 |
| CVE-2026-121736 | 5.3 | NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unauthenticated attackers to create OAuth authorization codes. Attackers can send anonymous requests with client_i | 2026-11-09 17:17:17 | 2026-11-03 23:17:37 |
| CVE-2026-121732 | 2.7 | RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments to students of other schools via MassAssignFees.php and MassAssignPayments.php. Attackers can substitute fore | 2026-11-09 17:17:17 | 2026-11-03 23:17:36 |
| CVE-2026-121728 | 5.3 | SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register accounts when public registration is disabled. Attackers can obtain a CSRF token from /login and POST credenti | 2026-11-09 17:17:17 | 2026-11-03 23:17:36 |
| CVE-2026-121687 | - | FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed without authentication. 1. HTTP REST API (port 80): motor control, telemetry/GPS/IMEI, plaintext WiFi password (GET /api/v1/wifi/sta | 2026-11-09 17:17:16 | 2026-11-09 17:17:16 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/40089
Zapisa po stranici: