All CVEs — page 315 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows an unauthenticated attacker to create a new administrator account by exploiting an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint.
This vulnerability allows any authenticated user to execute arbitrary code on the server by adding an MCP server with the 'Stdio' transport, due to lack of validation and sandboxing.
The flaw allows arbitrary OS command execution due to lack of input validation and proper sandboxing, posing a critical risk.
The flaw is a deserialization vulnerability that allows object injection, leading to potential remote code execution. This matters because attackers can exploit it to execute arbitrary code on the server, compromising the system.
CVE-2026-95265 is a Server-Side Request Forgery (SSRF) vulnerability in Feehi CMS 2.1.1's UEditor catchimage endpoint that allows attackers to probe internal HTTP services by bypassing private IP validation. This flaw enables attackers to map internal networks and potentially access sensitive internal systems.
A local attacker can execute arbitrary code on Mercusys AC12 V2 devices using a hardcoded RSA private key, allowing full system compromise.
The Mercusys AC12 V2 device stores sensitive information in plaintext, allowing a local attacker to execute arbitrary code. This represents a critical security flaw that can lead to complete system compromise.