Threat Intelligence Database

A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. This affects the function uci.apply of the file /usr/share/rpcd/acl.d/unauthenticated.json of the component ACL Handler. This manipulation of the argument section causes missing authorization. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

OctoberCMS versions up to 4.1.19, 4.2.25, and 4.3.4 contain a server-side request forgery (SSRF) vulnerability in the getSourcePathForResize function of the ResizeImages.php module. This vulnerability allows remote attackers to manipulate the realSourcePath argument, potentially causing the server to make unintended requests. The issue is resolved by upgrading to versions 4.3.5 or 4.4.0.

Multiple vulnerabilities have been identified in Wi-Fi products provided by BUFFALO INC. Specific details about these vulnerabilities, including their nature, impact, and affected versions, have not been disclosed in the available information.

CVE-2026-100908 is a stack-based buffer overflow vulnerability in the Eyeplus software version 57.0.0.0308. The flaw exists in an unknown function of the p2pcam HTTP Parser component and can be exploited remotely without authentication or user interaction. Public exploit code has been disclosed. The vulnerability has a high severity rating with a CVSS score of 8.7.

CVE-2026-87723 is an untrusted search path vulnerability in Google fuse-archive versions prior to 1.24. An attacker able to manipulate the PATH environment variable or place a malicious binary in a writable directory within PATH can hijack execution to run arbitrary code with the privileges of the fuse-archive process user. The vulnerability was partially mitigated in version 1.22 and fully fixed in version 1.24 by implementing refined selective PATH filtering.

CVE-2026-100907 is an information disclosure vulnerability in Eyeplus version 57.0.0.0308. The flaw exists in an unknown function within the /snapshot file of the p2pcam Service component. The vulnerability can be exploited remotely without authentication or user interaction. An exploit has been published but there are no reports of active exploitation in the wild. The CVSS 4.0 base score is 6.9, indicating a medium severity issue.

A vulnerability was detected in Eyeplus 57.0.0.0308. The affected element is the function GetUsers of the file /onvif/Device of the component ONVIF. The manipulation results in information disclosure. The attack can be executed remotely. The exploit is now public and may be used.

A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argument itemName leads to cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was identified in ООО НПО Ритм GEOritm up to 2.45.1. This affects an unknown part of the file /restapi/objects/obj-groups of the component REST API. Such manipulation of the argument objectId leads to missing authentication. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.46 is able to mitigate this issue. It is advisable to upgrade the affected component. The vendor confirms: "In August 2026, NPO Ritm received an official vulnerability notification from the Russian Federal Service for Technical and Export Control (FSTEC Russia). The vulnerability was registered under identifier BDU:2026-11235. Following our internal investigation, we confirmed the vulnerability and implemented the necessary security fixes. The vulnerability has been fixed on our hosted GEO.RITM server at geo.ritm.ru. The fix has also been included in GEO.RITM version 2.46, which is already being distributed to our customers."

A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of the file /wallpaper of the component Wallpaper Upload. This manipulation of the argument wallpaper causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.