CVE Vulnerabilities - 15 October 2026

The firmware on the Wavlink WN530HG4B router contains a flaw in the api.cgi component that can be triggered over the network, potentially letting an attacker run code on the device. The problem has be...

The login page of the WL‑WN530BE2‑A router can be tricked into running any command the attacker supplies, letting a remote user take control of the device. This problem exists in firmware up to versio...

The PraisonAI code agent runs Python code generated by a language model with full access to the system’s environment variables, including passwords and API keys. This means an attacker who can influen...

The cleanstart/ollama-fips, cleanstart/prometheus-mysqld-exporter, cleanstart/nfs-subdir-external-provisioner, and cleanstart/external-dns packages have a flaw where, if an SSH connection uses a callb...

The nfs-subdir-external-provisioner component can mistakenly allow a TLS connection to continue using a previously established session even after the list of trusted certificates has been changed. Thi...

The Station Middleware component used in Docker containers (versions 1.6.5 to 1.8.2) allows accounts with minimal rights to request any file on the server by specifying a path. This could expose inter...

The runwasi component used with the container runtime can treat a specially prepared container image as safe and load it as native code. This lets an attacker bypass the normal WebAssembly checks and ...

If someone with normal database access uses the Gremlin import feature, they could cause the server to run their own code and see internal service passwords. This risk affects Amazon Neptune database ...

In OPNsense versions before 26.1.11, a user who can edit firewall aliases could supply a specially crafted GeoIP file that writes malicious files owned by the system administrator. Those files can be ...

Versions of Langflow before 1.10.3 let anyone who can add or edit an MCP server configuration cause the application to run any operating‑system command it chooses. If the system is left with the defau...

The Langflow application (versions before 1.10.1) lets a signed‑in user who can edit a workflow execute unrestricted Python code on the server. This can let the user run commands, access the database ...

The OpenTelemetry Collector component from cleanstart can be tricked into handling messages from RabbitMQ in a way that reveals internal information. This could allow an attacker to see data that shou...

The langfuse software (cleanstart/langfuse) contains a security weakness that could let an attacker affect the application. The problem is fixed in version 4.35.0‑r1 and later. Install the updated ver...

The JA‑A12 IP camera models with certain firmware versions can be accessed without a login. By sending a specially crafted request, an attacker can cause the camera to run any command as the system ad...

JuggleIM im-server versions up to 1.8.16 ship with a default username and password (admin/123456) that anyone can use to reach the admin console on port 8090. An attacker who discovers this can sign i...

Versions 0.2.13 through 0.11.1 of Archon expose a control interface that does not require a login. Anyone who can reach the server over the network can send messages that cause the AI coding agent to ...

The FastAPI AI inference service from EnergizeLab allows anyone on the network to modify its AI model settings and swap the active model without proving who they are. This means an attacker could repl...

The Remote Support appliance can be tricked into thinking a user is authenticated, allowing a remote attacker to bypass the login step. Once inside, the attacker could read, modify, or delete files on...

A misconfiguration in Nutanix AOS lets anyone on the network send a special header and receive a valid admin session cookie. With that cookie the attacker can control the entire cluster, run commands ...