Threat database

CVE-2026-45452 is a high-severity vulnerability in Unitronics UniStream Pro (B10 and C10 models) and UniLogic software versions prior to 1.41.329. It involves the use of externally-controlled format strings, which can lead to severe impacts on confidentiality, integrity, and availability. The vulnerability allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or cause denial of service.

CVE-2026-45451 is an improper authentication vulnerability affecting Unitronics UniStream Pro (B10/C10) and UniLogic versions prior to 1.41.329. This flaw allows an attacker with limited privileges to bypass authentication controls, potentially leading to full compromise of confidentiality, integrity, and availability of the affected system. The vulnerability has a high severity rating with a CVSS score of 8.3. No official patch or remediation details are provided in the available data.

CVE-2026-45450 is a high-severity vulnerability in Unitronics UniStream Pro (B10 / C10) and UniLogic versions prior to 1.41.329. It involves improper restriction of operations within the bounds of a memory buffer, classified as CWE-119. This flaw could allow an attacker with low privileges and no user interaction to achieve high impact on confidentiality and integrity, and low impact on availability.

CVE-2026-45449 is an OS Command Injection vulnerability in Unitronics UniStream Pro and UniLogic software. It affects Unitronics UniStream Pro versions B10 and C10, and UniLogic versions prior to 1.41.329. This vulnerability allows improper neutralization of special elements used in OS commands, potentially enabling an attacker with limited privileges to execute arbitrary commands. The CVSS score is 8.3, indicating a high severity impact with high confidentiality and integrity impact and low availability impact.

CVE-2026-103548 is a vulnerability in Itron MV-90 xi version 3.0 where passwords are stored improperly in a recoverable format within the configuration file. This allows attackers with some level of access to decode stored passwords and password histories, potentially gaining unauthorized access to the MV-90 application as any user.

CVE-2026-81491 is a path traversal vulnerability in boxpositron with-context-mcp affecting versions 3.0.0 through 3.0.7. The flaw exists in the ingest_notes, teleport_notes, sync_notes, and project_folder functions within src/index.ts. This vulnerability can be exploited remotely without authentication. Although an exploit has been published, the vendor has not yet responded or issued a fix.

BetterDesk is a remote desktop management solution. BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls. Version 3.0.0-alpha contains a patch. No known workarounds are available.

Missing Authorization vulnerability in iTRON WP Logger wp-data-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Logger: from n/a through <= 2.2.

Improper Input Validation in Hitron Systems DVR HVR-8781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

Improper Input Validation in Hitron Systems DVR HVR-4781 1.03~4.02 allows an attacker to cause network attack in case of using defalut admin ID/PW.

Unitronics VisiLogic before version 9.9.00, used in Vision and Samba PLCs and HMIs, uses a default administrative password. An unauthenticated attacker with network access can take administrative control of a vulnerable system.