CVE Vulnerabilities - 29 September 2026

Both the TMS7 and TopHAT systems let anyone on the internet request a file export that can pull any table from the underlying database. This means an attacker could obtain sensitive business informati...

The Viidure dashcam Android app contains a fixed set of cloud storage keys written in plain text. Anyone who discovers those keys can read, change, or delete the files the app stores in the cloud, inc...

Versions of Dockhand older than 1.0.40 let anyone send specially crafted webhook requests and cause a stack to be redeployed without logging in. This can disrupt services and, if an attacker also cont...

The Balbooa Forms extension for Joomla can run custom PHP code after a public form is submitted. Because it inserts the visitor's input into that code before it runs, a stranger can supply malicious i...

The Supervisor component used in Alpine 3.19 can be tricked into running malicious code, which could give an attacker control over the system. This risk has been fixed in newer releases of the Supervi...

The web-based Network Tools page in Netcore NAP930 can be tricked into running operating‑system commands by sending a crafted sid parameter. An attacker from anywhere on the internet could use this to...

The GEOVIA Geospatial Data Manager versions released between 2024x and 2026x may let a malicious user send specially crafted data that causes the server to run unwanted programs. This could lead to un...

The LightLLM software (versions through 1.2.0) runs a cache service that anyone on the network can reach. Because the service processes data without checking it, an attacker could send specially craft...

If LightLLM is started with the profiling option turned on, it opens a network service that anyone can reach. An attacker could send specially crafted data to that service and cause the program to run...

The EasyTimeline add‑on for MediaWiki (versions before the latest releases) accepts XML data without proper checks. An attacker could insert specially crafted XML to read or change information behind ...

The web management page of TOTOLINK N150RT routers running firmware version V3.4.0‑B20201030 can overflow its memory when handling certain port‑forwarding inputs. An attacker who can reach the router’...

The MetaMCP software (versions up to 2.4.22) has an internal feature that can be tricked into executing arbitrary commands. An attacker who can reach the internal /mcp-proxy/server/stdio address could...

The wireless access points in HPE's Instant ON line contain a flaw that lets anyone on the network send specially crafted data to make the device run commands. This could crash the device or let an at...

A programming error in the networking interface of HPE Instant ON access points could let an unknown attacker run their own software on the device without logging in. If exploited, the attacker could ...

The main AltumCode 66Uptime product and its ping-servers plugin let a remote attacker run any code on the server through the index.php page. This could let an attacker take control of the web server o...

The firmware version 3.3.2.4 of Anjvision YSSD-RTMP-H5 does not require a login for some ONVIF management functions. This means a stranger could potentially change settings or control the device witho...

The Open eClass platform version 3.15 lets a remote user send specially crafted text in the course chat that can cause the system to run any code the attacker chooses. This could let an attacker take ...

The Open GenAI Stack used in Meta AI services can be tricked into executing code through specially crafted prompts. This could let an attacker run commands on the server, potentially compromising data...

The Fumeng Cloud web service lets anyone send a specially crafted request to the getEmpByname function and run their own database commands. This can expose or alter the information stored in the syste...

The developer tools built into Firefox and Thunderbird contain a flaw that could let a malicious web page execute code on a user’s machine. This affects the browsers and the associated JavaScript engi...

A coding error in the JavaScript engine that runs WebAssembly code could let specially crafted web pages read or write memory they shouldn't. This could let attackers execute unwanted actions on your ...

The FreeIPA component in Rocky Linux can be forced to crash or become unavailable by sending specially crafted requests, and it also contains flaws that could let an attacker increase their access rig...