A vulnerability in the modem component allows an out of bounds write due to an incorrect bounds check. This flaw can be exploited remotely by an attacker controlling a rogue base station to escalate privileges on the affected device without requiring user interaction.
A path traversal vulnerability exists in Webpro-nl Knip up to version 6.44.0 in the writeFile function of the Workspace Handler component. This flaw allows remote attackers to manipulate the workspaces argument to perform unauthorized file system access. The vulnerability has a medium severity with a CVSS score of 6.3. Public exploit details have been disclosed, but no vendor response or patch is currently available.
A vulnerability in http4k versions from 4.9.10.0 up to but not including 6.60.0.0 allows on-path attackers on non-TLS channels to modify the body of authenticated requests without invalidating the Authorization header. This occurs because the DigestEncoder component does not hash the request entity body when computing the auth-int digest, resulting in a missing integrity check.
A path traversal vulnerability exists in Aklivity Zilla up to versions 1.3.4, 2.4.7, and 2.5.0-rc2 in the Path.resolve function of the FileSystemServerFactory component within the http-filesystem binding. This flaw allows remote attackers to manipulate path parameters to access unauthorized files. Public exploit code is available. Upgrading to version 2.5.0-rc3 addresses this issue.
Network-AI versions from 5.14.0 up to but not including 5.15.5 contain a missing authentication vulnerability in the A2AServer class. This flaw allows unauthenticated attackers to perform task operations such as executing tasks, reading results, and canceling tasks by sending JSON-RPC requests without requiring a Bearer token when no secret is configured.
A path traversal vulnerability exists in http4k versions before 6.62.0.0-ee within the ThymeleafTemplates Caching and HotReload feature. This flaw allows unauthenticated attackers to read arbitrary files outside the intended baseTemplateDir by using '../' segments in ViewModel.template() values. The vulnerability arises because Thymeleaf's FileTemplateResolver resolves escaped paths without proper containment checks, enabling disclosure of any file readable by the server process.
Parse Server versions before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 have a vulnerability where stored field values are returned in object update responses without verifying read access. This allows clients with update permissions but without read permissions to access object data, including atomic operation results and Cloud Code trigger-set values.
Network-AI versions prior to 5.15.5 have a path traversal vulnerability in the InputSanitizer.sanitizePath() function. This flaw allows attackers to escape the intended base directory by using sibling-directory paths that share a string prefix with the base directory. The vulnerability arises because the check to prevent directory traversal uses an unanchored startsWith method, which can be bypassed. Exploitation could allow attackers to read, list, or write files outside the sandboxed environment.
A security flaw in samanhappy MCPHub up to versions 1.0.45 and 1.1.7 allows remote attackers to cause information disclosure via manipulation of the passthroughHeaders argument in src/utils/passthroughHeaders.ts. The issue has been addressed in version 1.1.8.
LobeHub Chat versions from 1.84.26 up to but not including 2.1.49 contain a path traversal vulnerability. Authenticated users can exploit this flaw by supplying unsanitized file names to the writeTempFile() function, enabling arbitrary file writes. This can lead to overwriting critical application files such as startServer.js, potentially resulting in remote code execution or denial of service.
Network-AI versions from 5.13.4 up to but not including 5.15.5 contain a path traversal vulnerability in the AgentVCR component. This flaw allows attackers who can control the cassette name parameter to read or write arbitrary JSON files. Exploitation can lead to disclosure of sensitive JSON data or overwriting of critical policy files such as AuthGuardian trust-level configurations.
Network-AI versions from 5.13.4 up to but not including 5.15.5 contain a path traversal vulnerability in the FileJobStore component. This flaw allows attackers who can control the job id parameter to read or delete arbitrary .json files by using directory traversal sequences. Exploitation can lead to disclosure of sensitive credentials and grant tokens or deletion of configuration files, potentially weakening the authorization mechanism of AuthGuardian.
A critical vulnerability exists in WAVLINK WN536AX6-A firmware version V260507, involving an OS command injection flaw in the openvpn_cli handler component. The flaw is triggered by manipulation of the argument file_id in the /protocol.csp file. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of exploitation. No patch or remediation information is currently provided by the vendor.
A critical stack-based buffer overflow vulnerability exists in WAVLINK WN536AX6-A version V260507 in the OpenVPN Handler component. The flaw arises from improper handling of the openvpn_ip argument in the strcpy function within /protocol.csp. This vulnerability can be exploited remotely without authentication, potentially allowing full system compromise. Public exploit code is available. No patch or remediation information is currently provided by the vendor.
Nuxt versions from 4.6.0 up to but not including 4.6.2 contain a route parameter confusion vulnerability in the getRouterParam and getRouterParams functions. This flaw allows attackers to send paths with encoded question marks (%3F) to obtain parameter values different from those matched by the h3 router. As a result, attackers can craft requests where authorization checks rely on the Nuxt helper value, while resource selection uses event.context.params, potentially granting unauthorized access to resources.
A critical stack-based buffer overflow vulnerability exists in the Linksys E8450 firmware version 1.2.00.360516. The flaw is in the strcpy function handling the hidden_timezone argument in /www/cgi-bin/portal.cgi, allowing remote attackers to execute code. The vendor has not responded to disclosure attempts, and no patch is currently available.
A critical vulnerability exists in WAVLINK WN536AX6-A version V260507 in the WireGuard component. The flaw is an OS command injection via the wireguard_cli_group handler function in /protocol.csp, triggered by manipulation of group_id or group_name arguments. This vulnerability can be exploited remotely without authentication and has a maximum CVSS score of 10. Public exploit code has been disclosed, increasing the risk of exploitation. The vendor was notified early, but no patch information is currently available.
A deserialization vulnerability exists in jxxghp MoviePilot versions up to 3.1.2 in the WorkflowExecutor.restore_context function of the Workflow Fork Endpoint component. This vulnerability can be exploited remotely and has been publicly disclosed. Upgrading to version 3.1.3 resolves the issue.
CVE-2026-120282 is a critical vulnerability in WAVLINK WN536AX6-A version V260507 affecting the host_black function in /protocol.csp. It allows remote OS command injection via manipulation of the mac argument. The vulnerability has a high CVSS score of 9.9 and has been publicly disclosed with exploit code available. No patch information is currently provided.
CVE-2026-120322 is a critical path traversal vulnerability in Termix-SSH Termix up to version 2.9.2. It involves improper handling of the destPath argument in the /plugin-api/file-manager/transferToHost endpoint, allowing remote attackers to traverse directories. The vulnerability has a high CVSS score of 9.9, indicating severe impact on confidentiality, integrity, and availability. The issue was mitigated by removing the vulnerable shortcut in the standalone File Manager plugin v1.0.0 and core v26.10.0. No official vendor response or patch is currently available.