Eclipse Langium versions 3.2.0 through 4.4.0 have an inefficient algorithmic complexity issue in the opt-in IndentationAwareTokenBuilder and IndentationAwareLexer components. The issue causes tokenization to take quadratic time for documents with frequent indentation changes, blocking the Node.js event loop and resulting in a denial of service. Languages using the default lexer and token builder are not affected.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 runs all processes with root privileges without privilege separation. This design flaw means that if any single service is compromised, an attacker gains full administrative control over the device.
Redpanda Connect versions 4.39 through 4.110 have a missing authentication vulnerability in the management HTTP API exposed on 0.0.0.0:4195. This allows unauthenticated remote code execution (RCE) by posting malicious pipeline definitions containing code-executing processors. Starting with version 4.111, the API endpoint is disabled by default but can be enabled manually, retaining the RCE risk if enabled.
Tasmota firmware versions through 16.0.0 contain a heap out-of-bounds write vulnerability in the SendReceiveDeviceGroupMessage() function. This flaw allows unauthenticated attackers on the local network to send crafted UDP messages to port 4447, causing heap memory corruption by making a counter negative and exceeding a fixed buffer size. Exploitation can lead to device crashes or potentially native code execution on ESP8266 and ESP32 devices lacking certain memory protections. The vulnerability is fixed in a commit identified as e97e1e4.
Tasmota firmware versions through 16.0.0 contain a cross-site request forgery (CSRF) vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protections. By crafting a malicious Referer header that includes the device hostname or IP as a substring after a controlled domain, attackers can trick administrators into executing arbitrary console commands and reconfiguring device settings if no WebPassword is set.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 exposes several local interfaces without authentication, including an HTTP REST API on port 80, ADB root shell access on port 5555, and SSH on port 22. These interfaces allow access to sensitive functions such as motor control, telemetry data, plaintext WiFi passwords, and diagnostic exports.
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows have insufficient resource limits, which could allow an unauthenticated remote attacker to cause a denial of service condition.
An Incorrect Privilege Assignment vulnerability exists in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub, allowing privilege escalation. The vulnerability affects versions up to and including 2.0.1. It has a high severity with a CVSS score of 8.8, indicating a network attack vector with low complexity and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 uses an insecure STM32 firmware update mechanism. Firmware updates are fetched over unencrypted HTTP, and integrity is only checked using MD5 hashes transmitted in the same unprotected response. There is no code-signing mechanism, allowing attackers to potentially replace the firmware with malicious code.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains a vulnerability that allows unauthenticated remote code execution via MQTT messages. The firmware accepts arbitrary shell commands through AWS IoT MQTT messages and executes them as root. Access control relies solely on shared IoT credentials without per-device authentication, enabling attackers to execute commands remotely across the device fleet.
The FrodoBots EarthRover Mini+ firmware version v6.2.4_6.2.5_0.614.0 exposes sensitive credentials due to insecure storage and access mechanisms. The Wi-Fi pre-shared key (PSK) is stored in plaintext within the wpa_supplicant.conf file and can be accessed through unauthenticated API endpoints and diagnostic exports. Furthermore, unauthenticated Android Debug Bridge (ADB) access allows attackers to retrieve the /etc/shadow file, which contains hashed user passwords.
A weak authentication vulnerability exists in WPZOOM WPBruiser {no-Captcha anti-Spam} plugin versions up to 3.6.2. This flaw allows authentication abuse, potentially enabling unauthorized actions with limited privileges. The vulnerability has a medium severity rating with a CVSS score of 4.3. No patch or remediation information is currently provided.
CVE-2026-115341 is a vulnerability in the Thin Client Web Transfer component of Progress Software WS_FTP Server on Windows versions prior to 2025.0.5. It allows an authenticated FTP user to bypass intended access restrictions and access files outside their authorized scope. The vulnerability has a high severity with a CVSS score of 7.7, indicating a network attack vector with low complexity and no user interaction required. The impact is limited to confidentiality as it allows unauthorized file access without affecting integrity or availability.
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to temporary files during file transfer operations. This vulnerability could lead to unauthorized disclosure of sensitive information if an attacker gains access to these temporary files.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains multiple sets of hard-coded credentials. These credentials include fleet-wide BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. They are embedded directly in the firmware binary (frodobot.bin) and can be extracted through static analysis without requiring special privileges.
Progress WS_FTP Server versions prior to 2025.0.5 have insufficient protection of communications when unencrypted connections are used. This vulnerability could allow a network attacker to intercept sensitive information or modify requests. The issue affects confidentiality, integrity, and availability of data transmitted over the network.
Progress WS_FTP Server versions prior to 2025.0.5 contain an improper access control vulnerability that allows an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users. This vulnerability has a medium severity rating with a CVSS score of 6.3.
Chaos Software V-Ray versions through 2.0.19 contain an uncontrolled search path element vulnerability in the package upload feature. This flaw allows remote unauthenticated attackers to execute arbitrary code by redirecting access to libraries. The vulnerability is identified as CWE-427 and is rated critical with a CVSS 4.0 score of 9.3.
The LaserGest mobile application disables TLS certificate and hostname verification by using setServerTrustMode("nocheck"), which allows man-in-the-middle attackers to intercept or modify network traffic, including sensitive credentials and API communications. This vulnerability undermines the security of TLS connections, exposing users to significant risks.
Progress Software WS_FTP Server on Windows prior to version 2025.0.5 contains an incorrect quota accounting vulnerability. This flaw allows an authenticated user with upload and delete permissions to exceed storage quotas, which can lead to denial of service conditions. The vulnerability does not impact confidentiality or integrity but affects availability.