CVE-2026-77060
boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any local user can read the password hashes for all MQTT accounts and perform…
İçeriği inceleyinALLSAFE / Güncel Güvenlik Açıkları
NIST-Güvenlik Açıkları
NIST NVD, USOM / Siber Güvenlik Başkanlığı ve Exploit-DB kaynaklarından güvenlik bildirimleri. Etkilenen ürün ve sürümleri özgün kaynakta doğrulayın.
Kayıtlar kaynakların yayın tarihleri ve özgün içerikleriyle sunulur. Bir kaydın bulunması, kurumunuzun etkilendiğini tek başına göstermez. Sürüm ve yapılandırmayı kontrol ederek üreticinin güncel önerilerini değerlendirin.
CVE-2026-77052
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxy. The Node-RED Admin API allows deploying flows that can execute arbitrary…
İçeriği inceleyinCVE-2026-77053
boneIO Black firmware ships with authentication disabled by default. Its management web API listens on all network interfaces and exposes all endpoints without requiring credentials. An unauthenticated remote…
İçeriği inceleyinCVE-2026-77054
boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The GET /api/config endpoint returns the full configuration with sub-services passwords exposed. Any authenticated…
İçeriği inceleyinCVE-2026-65184
The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and passes it to `system()` and `popen()` without quoting, escaping, or character-set validation. The daemon's…
İçeriği inceleyinCVE-2026-116340
A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileInfoV2Service.listKnowledgeByPage of the file FileInfoV2Service.java of the component Console Knowledge-List Endpoint. Such manipulation of…
İçeriği inceleyinCVE-2026-116497
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and…
İçeriği inceleyinCVE-2026-31158
SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute arbitrary code via the Login Page Bu kayıt NIST NVD kaynağından aktarılmıştır.…
İçeriği inceleyinCVE-2026-36698
Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection vulnerability in /sbin/ImportParamSet.sh. The script processes symlinks from uploaded parameter archive files…
İçeriği inceleyinCVE-2026-3322
Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require administrative privileges. This issue affects Lobster_pro version 4.12.12-LTS and potentially other…
İçeriği inceleyinCVE-2026-115930
The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root certificate store. This certificate store has the recoverable eMudhra intermediate CA…
İçeriği inceleyinCVE-2026-116284
A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknown code of the file /general/user-info of the component Local API. Such manipulation leads…
İçeriği inceleyin