The FrodoBots EarthRover Mini+ firmware version v6.2.4_6.2.5_0.614.0 exposes sensitive credentials due to insecure storage and access mechanisms. The Wi-Fi pre-shared key (PSK) is stored in plaintext within the wpa_supplicant.conf file and can be accessed through unauthenticated API endpoints and diagnostic exports. Furthermore, unauthenticated Android Debug Bridge (ADB) access allows attackers to retrieve the /etc/shadow file, which contains hashed user passwords.
A weak authentication vulnerability exists in WPZOOM WPBruiser {no-Captcha anti-Spam} plugin versions up to 3.6.2. This flaw allows authentication abuse, potentially enabling unauthorized actions with limited privileges. The vulnerability has a medium severity rating with a CVSS score of 4.3. No patch or remediation information is currently provided.
CVE-2026-115341 is a vulnerability in the Thin Client Web Transfer component of Progress Software WS_FTP Server on Windows versions prior to 2025.0.5. It allows an authenticated FTP user to bypass intended access restrictions and access files outside their authorized scope. The vulnerability has a high severity with a CVSS score of 7.7, indicating a network attack vector with low complexity and no user interaction required. The impact is limited to confidentiality as it allows unauthorized file access without affecting integrity or availability.
Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session data to temporary files during file transfer operations. This vulnerability could lead to unauthorized disclosure of sensitive information if an attacker gains access to these temporary files.
The FrodoBots EarthRover Mini+ firmware version 6.2.4_6.2.5_0.614.0 contains multiple sets of hard-coded credentials. These credentials include fleet-wide BasicAuth credentials for an Agora token service, AWS IAM access keys, AWS IoT MQTT credentials, and a Slack incoming webhook URL. They are embedded directly in the firmware binary (frodobot.bin) and can be extracted through static analysis without requiring special privileges.
Progress WS_FTP Server versions prior to 2025.0.5 have insufficient protection of communications when unencrypted connections are used. This vulnerability could allow a network attacker to intercept sensitive information or modify requests. The issue affects confidentiality, integrity, and availability of data transmitted over the network.
Progress WS_FTP Server versions prior to 2025.0.5 contain an improper access control vulnerability that allows an authenticated user with certain folder-management permissions to bypass access restrictions and access or modify files belonging to other users. This vulnerability has a medium severity rating with a CVSS score of 6.3.
Chaos Software V-Ray versions through 2.0.19 contain an uncontrolled search path element vulnerability in the package upload feature. This flaw allows remote unauthenticated attackers to execute arbitrary code by redirecting access to libraries. The vulnerability is identified as CWE-427 and is rated critical with a CVSS 4.0 score of 9.3.
The LaserGest mobile application disables TLS certificate and hostname verification by using setServerTrustMode("nocheck"), which allows man-in-the-middle attackers to intercept or modify network traffic, including sensitive credentials and API communications. This vulnerability undermines the security of TLS connections, exposing users to significant risks.
Progress Software WS_FTP Server on Windows prior to version 2025.0.5 contains an incorrect quota accounting vulnerability. This flaw allows an authenticated user with upload and delete permissions to exceed storage quotas, which can lead to denial of service conditions. The vulnerability does not impact confidentiality or integrity but affects availability.
The LaserGest mobile application uses a hardcoded AES key and IV to encrypt stored assistance portal credentials. This practice allows an attacker who can access the application package to decrypt and recover these credentials in cleartext. The vulnerability is classified as high severity with a CVSS score of 8.7.
A TOCTOU race condition in the Sandisk Dashboard installer allows a local authenticated standard user to replace a binary in a user-writable temporary directory between validation and execution. This leads to execution of an attacker-controlled binary with elevated administrative privileges. The vulnerability affects Sandisk Dashboard versions through 5.2.2.3.
Eclipse Langium versions 3.0.0 and later have a vulnerability in the langium-sprotty package where diagnostic messages are not HTML-escaped before rendering in hover popups. This allows attacker-controlled JavaScript to execute in the browser or webview when a malicious source file triggers an unresolved cross-reference diagnostic containing HTML markup.
An XSS vulnerability exists in OpenText Filr Appliance versions up to 25.1.2 that allows an authenticated user to upload a malicious file and execute a stored cross-site scripting attack.
The AM CLUB mobile application contains hard-coded MQTT credentials that allow an authenticated attacker to connect to the MQTT broker. This vulnerability enables unauthorized access to data and actions across tenant boundaries within the application environment.
rConfig Core versions 8.2.3 through 8.2.12 contain an information disclosure vulnerability that allows authenticated users to retrieve cleartext SSH, Telnet, and enable passwords for managed devices via the device-credentials API. This occurs due to missing authorization checks and automatic decryption on read. The vulnerability is fixed in version 8.2.13. rConfig Pro is not affected.
CVE-2026-123802 is an improper authentication vulnerability in SuperTokens Core affecting versions from 11.3.0 up to but not including 11.3.8, 11.4.0 up to 11.4.8, 12.0.0 up to 12.0.11, 12.1.0 up to 12.1.2, 12.2.0 up to 12.2.1, and 12.3.0 up to 12.3.1. The flaw allows a licensed deployment with a configured SAML client to authenticate an identity from an assertion that does not satisfy the audience check properly, enabling an attacker to impersonate a victim IdP user. This issue is fixed in versions 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
OffSeq Mirage honeypot sensors observed the URL https://github.com being used in attacker activity associated with CVE-2021-41773 on 2026-11-09. The URL was seen 9 times as part of attacker payloads involving the T1105 technique (Ingress Tool Transfer), indicating it was used for tool download, callback, or exploitation targeting. The attacker infrastructure was identified as located in the US. This URL should be blocked and monitored in proxy, web, and WAF logs to detect related malicious activity.
SuperTokens Core versions from 11.3.0 up to but not including 11.3.8, 11.4.0 up to 11.4.8, 12.0.0 up to 12.0.11, 12.1.0 up to 12.1.2, 12.2.0 up to 12.2.1, and 12.3.0 up to 12.3.1 contain an authentication bypass vulnerability in the SAML.handleCallback function. This flaw allows replay of valid SAML responses and RelayState pairs, bypassing important validation checks such as Response.InResponseTo, Destination, and SubjectConfirmationData. The issue permits attackers to reuse authorization codes and complete logins with different identities. Fixed versions are 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1.
Attackers are actively searching for SAP NetWeaver webshells by exploiting a known vulnerability (CVE-2025-31324) that allows unauthenticated file uploads. This vulnerability has a critical CVSS score of 10 and has been used to upload webshells typically located in the /irj/servlet_jsp/irj/root/ directory. Multiple URLs related to SAP NetWeaver and other upload endpoints are being targeted in this campaign.