CVE Vulnerabilities - 12 July 2026

A security issue exists in Comfast CF-WR631AX V3 routers with outdated firmware. An attacker could potentially inject malicious commands into the router's system, allowing them to take control of the ...

A bug in Zephyr's IPv4 address parsing code allows an attacker to execute malicious code on a connected device. This can happen when a device connects to a network or receives a DNS response. To fix t...

Flowise versions 3.0.13 and earlier use weak default secrets in its JWT authentication system. This allows attackers to create fake authentication tokens, potentially impersonating administrators or o...

Flowise has weak default settings for JSON Web Tokens (JWTs) that can be exploited by attackers to impersonate any user, bypassing authentication and potentially gaining admin access. This is a critic...

The Crawl4AI software before version 0.8.7 allows attackers to write malicious files to the server. This could cause the server to crash or become unusable. To fix this, update Crawl4AI to version 0.8...

A security issue in Capgo versions before 12.128.2 allows demoted administrators to keep deleting certain types of files, even after they've lost their full admin privileges. This could be exploited b...

The Joomla! core is vulnerable to a security issue that allows anyone to create custom fields without proper permission. This can lead to data tampering and unauthorized changes to the website. To fix...

An improper access check in Joomla!'s com_privacy module allows unauthorized users to view sensitive data. This is a serious security risk as it can lead to data exposure. To protect your site, update...

A security issue in Joomla!'s contact manager allows users to download contact information that they shouldn't have access to. This can lead to sensitive information being exposed to unauthorized indi...

A stored cross-site scripting vulnerability exists in luci-app-upnp, allowing attackers to inject malicious code on devices that render the UPnP or Status pages. This could lead to unauthorized access...

The OpenWrt luci-app-samba4 software has a security issue that allows attackers to run unauthorized code on the system. This can happen when an attacker uses a valid login to gain access to the system...

An attacker on the same network can inject malicious code into LuCI's DHCP lease pages, potentially allowing them to take control of an administrator's browser. This vulnerability affects LuCI version...

A vulnerability in an older version of the TRENDnet TEW-821DAP router allows hackers to remotely execute code on the device. This only affects devices that are no longer supported by the manufacturer,...

A remote attacker can exploit a buffer overflow vulnerability in the TRENDnet TEW-821DAP router, which is no longer supported by the manufacturer. This means the company will not provide any security ...

A security risk exists in older Trendnet TEW-635BRM routers. An attacker could potentially take control of the router from a distance, using a publicly available exploit. If you're still using this ro...

A vulnerability in an older version of Trendnet's TEW-635BRM router allows a hacker to execute code remotely, potentially taking control of the device. This affects devices that are no longer supporte...

An attacker with permission can delete users' email login credentials in other organizations, forcing them to switch to the attacker's login system or reset their password. This affects Capgo users wh...

Capgo versions prior to 12.128.2 have a security issue that allows attackers to change a user's email address, potentially gaining control of account recovery and bypassing multi-factor authentication...

The hcr707305003 shiroiAdmin software has a security issue that allows attackers to upload files without any restrictions. This means they can upload malicious files that could potentially harm your s...

An unauthorized attacker can gain more access to your network by exploiting a weakness in Microsoft Edge (Chromium-based). This could allow them to do more harm to your system and data. Update your Mi...

A security issue in Capgo versions before 12.128.2 allows attackers to delete sensitive files in an organization even after the attacker's admin privileges have been removed. This is because the syste...

Capgo versions prior to 12.128.2 allow unauthenticated access to sensitive financial data, including revenue and customer counts. This means that anyone can view this information without needing a log...

A vulnerability in the Docker API server allows attackers to steal sensitive credentials and authentication keys. This can happen when an attacker controls the URL where the server sends requests or w...

A vulnerability in the Docker API server allows attackers to steal sensitive credentials and authentication tokens by manipulating URLs and environment variables. This can lead to unauthorized access ...

Crawl4AI versions before 0.8.8 contain a security flaw that allows attackers to steal sensitive credentials. This can happen if an attacker sends malicious API requests to the Crawl4AI server. To prot...