| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-118665 | - | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to version 1.1.36 of the GraphQL Tools legacy WebSocket executor package, buildWSLegacyExecutor in packages/executors/legacy-ws/src/index.ts retains request. | 2026-10-29 15:50:59 | 2026-10-28 21:16:56 |
| CVE-2026-114399 | 6.5 | Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by supplying encoded traversal sequences to DELETE /api/v1/backup/:backup. Attackers can also pass unvalidated file values to POST /ap | 2026-10-29 15:50:47 | 2026-10-21 13:18:31 |
| CVE-2026-97860 | 6.7 | YMS-VPN8 and YMS-VPN8-CP provided by Yamaha Corporation register Windows services with unquoted file paths. A user who has write permissions on the system drive may be able to execute arbitrary code with SYSTEM privileges. | 2026-10-29 15:45:15 | 2026-10-29 12:17:14 |
| CVE-2026-97854 | 9.8 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an OS command injection vulnerability. Arbitrary OS commands may be executed by sending a specially crafted request to the affected product. | 2026-10-29 15:45:15 | 2026-10-29 12:17:14 |
| CVE-2026-109822 | 6.5 | Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive information. Configuration files generated by the CONFIG file export function may be read by an unauthenticated attacker. | 2026-10-29 15:45:15 | 2026-10-29 12:17:09 |
| CVE-2026-103665 | 7.8 | The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link Libraries (DLLs). When the installer is launched in a directory containing a specially crafted DLL file, the malicious DLL may be loaded, | 2026-10-29 15:45:15 | 2026-10-29 12:17:08 |
| CVE-2026-114358 | - | This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the password recovery functionality in the web management interface. An unauthenticated remote attacker could exploit this vulnerabili | 2026-10-29 15:45:15 | 2026-10-29 09:17:07 |
| CVE-2026-61571 | 7.3 | AVideo is a video-sharing Platform. Prior to 8.1.0, the encoder lacks a global authentication layer and exposes control and status PHP endpoints to anonymous network callers. `view/run.php` has a commented-out guard and invokes `Encoder::run()`. `vie | 2026-10-29 15:45:15 | 2026-10-28 22:17:16 |
| CVE-2026-61567 | 10.0 | AVideo is a video-sharing Platform. Prior to 8.1.0, the live-streaming endpoint `view/videosListToLive.php` accepts an attacker-named streamer in `webSiteRootURL`, calls `Login::run` in `objects/Login.php`, and trusts the returned JSON as session sta | 2026-10-29 15:45:15 | 2026-10-28 22:17:15 |
| CVE-2026-61564 | 10.0 | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `videos/configuration.php` by interpolating request parameters, including `webSiteRootURL`, into single-quoted PHP s | 2026-10-29 15:45:15 | 2026-10-28 22:17:15 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39855
Zapisa po stranici: