Published threat advisories for September 1, 2026

A vulnerability in WWBN AVideo allows attackers to indefinitely reset account passwords using expired recovery tokens, potentially granting unauthorized, permanent access to user accounts. The platform's password recovery functionality, if exposed to the internet, makes this threat reachable. This issue should be a con

NVD modified: NVD date unavailable

WWBN AVideo's login security controls are vulnerable because they rely solely on the client-supplied User-Agent header. An attacker can bypass authentication, including multi-factor authentication and brute-force protections, by sending a specific User-Agent string. This could allow unauthorized access to the system.

NVD modified: NVD date unavailable

A vulnerability exists in an email client that could lead to uninitialized memory use when processing certain MIME bodies. This may cause application instability or data exposure if reachable. Confirmation of usage and timely updates are recommended.

NVD modified: NVD date unavailable

A vulnerability in Thunderbird allows malicious calendar invitations to execute local or network programs on Windows by bypassing attachment protections through file URI attachments. This could occur if the new invitation display is enabled, potentially disguising the attachment's filename. The issue impacts desktop em

NVD modified: NVD date unavailable

A vulnerability in the Predis PHP client allows specially crafted pipeline commands to be interpreted as additional commands, potentially enabling attackers to modify, delete, or disrupt data on Redis servers. This occurs due to improper parsing of serialized data on cluster or replication connections.

NVD modified: NVD date unavailable

A vulnerability in Next.js on Windows servers allows attackers to expose sensitive build data, including encryption keys, by manipulating route segments. This could lead to remote code execution.

NVD modified: NVD date unavailable

Proxmox VE versions prior to 8.0.4 have an authentication bypass vulnerability in the API login endpoint that allows unauthenticated attackers to impersonate any enabled user by providing an arbitrary value for the `tfa-challenge` parameter. This could grant unauthorized access to the virtualization environment and its

NVD modified: NVD date unavailable

A vulnerability exists in a daemon of AOS-CX that allows improper processing of malformed input, potentially enabling remote code execution with elevated privileges. An unauthenticated remote attacker could exploit this by sending specially crafted packets to the affected service, making it crucial to determine if your

NVD modified: NVD date unavailable

A critical vulnerability exists in HPE Networking Fabric Composer's SSH daemon, enabling unauthenticated remote attackers to execute arbitrary commands with administrative privileges. This could lead to complete system compromise on vulnerable hosts if the SSH daemon is reachable. You should care because this affects c

NVD modified: NVD date unavailable

A critical vulnerability exists in HPE Networking Fabric Composer's API, allowing unauthenticated remote attackers to bypass security controls and gain administrative privileges, potentially leading to a full host compromise. This issue is relevant because network management systems are high-value targets and could exp

NVD modified: NVD date unavailable

A critical vulnerability exists in HPE Networking Fabric Composer's underlying operating system that could allow an unauthenticated remote attacker to execute arbitrary code with privileged access, leading to a complete host compromise. This could occur if specific, externally controlled preconditions are met, making i

NVD modified: NVD date unavailable

A vulnerability in HPE Networking Fabric Composer's web interface allows an authenticated low-privilege user to perform a stored cross-site scripting attack against an administrator. This could enable arbitrary script execution in an administrator's browser, potentially impacting the interface's integrity.

NVD modified: NVD date unavailable

A synchronization service has a critical flaw allowing unauthenticated attackers to escalate privileges by reaching an admin configuration endpoint. This could expose authentication keys and grant unauthorized administrative control. The primary concern is determining if this technology is in use.

NVD modified: NVD date unavailable

A vulnerability in OpenAI Codex Desktop allows an attacker to execute arbitrary programs with user privileges by tricking a user into opening a specially crafted Git repository. This could lead to unauthorized access to files and credentials if the user opens such a repository. The vulnerability requires local interact

NVD modified: NVD date unavailable

A critical buffer overflow vulnerability exists in Tenda A18 devices, allowing remote attackers to execute arbitrary code. This flaw could impact network device operations and security if exploited. The primary concern is identifying affected devices and understanding their exposure.

NVD modified: NVD date unavailable

Dell PowerStore SDNAS has a critical vulnerability allowing unauthenticated remote attackers filesystem access. The platform's critical functions lack proper authentication. This could lead to unauthorized access to stored data if the system is reachable.

NVD modified: NVD date unavailable

An unauthenticated network vulnerability in TOTOLINK devices allows attackers to forward custom Quality of Service settings to the master configuration by sending a crafted MQTT message. This could potentially disrupt network traffic or redirect it in unintended ways. It is important to determine if affected TOTOLINK d

NVD modified: NVD date unavailable

An improper access control vulnerability in a TOTOLINK router function allows unauthenticated attackers to restart cloud update checks by sending a crafted MQTT message. This could potentially impact device integrity and availability. It is recommended to confirm the relevance and exposure for affected consumer devices

NVD modified: NVD date unavailable

An unauthenticated attacker can exploit a flaw in the MQTT component of certain TOTOLINK routers to reset the device's pairing state and reboot it by sending a crafted message. This vulnerability could lead to service disruption. The presence and network exposure of these devices within the environment are currently un

NVD modified: NVD date unavailable

A vulnerability in Talassoft Industrial Management Software allows for the retrieval of embedded sensitive data. If the software is network-reachable, unauthorized parties could exploit hard-coded credentials to access critical business information. You should care because this could lead to the exposure of confidentia

NVD modified: NVD date unavailable

A vulnerability exists in the NetStaX EtherNet/IP Stack where a large, malformed network request can cause memory corruption or a device crash without error. This could enable remote attacks. The relevance of this issue depends on whether the affected technology is in use.

NVD modified: NVD date unavailable

A denial-of-service vulnerability exists in RSLinx Classic due to improper handling of malformed packets. A specially crafted packet can crash the service, disrupting industrial communication operations until restarted. This issue is relevant if RSLinx Classic is in use and accessible within your environment.

NVD modified: NVD date unavailable

An incorrect access control vulnerability in the recvIndirectMeshInfo function allows unauthenticated attackers to insert or replace mesh neighbor records by sending a crafted MQTT message to the cs_broker component, potentially disrupting network operations.

NVD modified: NVD date unavailable

An unauthenticated attacker can overwrite cloud-result tracking files on certain TOTOLINK routers by sending a crafted MQTT message. This vulnerability is reachable via the network, allowing potential compromise of device tracking capabilities.

NVD modified: NVD date unavailable

An unauthenticated flaw in a TOTOLINK router's `freeStaClient` function allows attackers to forcibly disconnect wireless clients by sending a crafted MQTT message. This vulnerability could disrupt network service availability for connected users. The issue is reachable externally, making it relevant for devices exposed

NVD modified: NVD date unavailable

An unauthenticated remote attacker can exploit a vulnerability in TOTOLINK routers affecting mesh information control. Attackers can send a crafted MQTT message to disrupt the router's mesh state, potentially impacting its functionality. Confirming the presence and exposure of this technology in your environment is adv

NVD modified: NVD date unavailable

An access control vulnerability in TOTOLINK mesh devices allows unauthenticated attackers to trigger mass firmware updates via MQTT messages. This could disrupt network operations.

NVD modified: NVD date unavailable

An access control flaw in TOTOLINK routers allows unauthenticated attackers to initiate firmware downloads or flashing via crafted MQTT messages, potentially leading to unauthorized control over the device.

NVD modified: NVD date unavailable

An unauthenticated attacker can overwrite a router's slave IP inventory by sending a crafted MQTT message, potentially allowing unauthorized control over the device and its network. This vulnerability, affecting a common internet-facing gateway device, could impact the integrity of the network configuration.

NVD modified: NVD date unavailable

An unauthenticated attacker can remove slave devices and reboot a TOTOLINK device by sending a crafted MQTT message. This could disrupt network operations if the device is reachable over a network.

NVD modified: NVD date unavailable

An access control vulnerability in TOTOLINK mesh routers allows unauthenticated attackers to rescan and change the primary mesh channel by sending a crafted MQTT message. This could disrupt mesh network operations. It is uncertain if these devices are exposed externally.

NVD modified: NVD date unavailable

A code injection vulnerability exists in Klemsan Internet Objects (KIO), potentially allowing unauthorized arbitrary code execution. This critical issue, reachable via a network, could lead to system compromise. Confirming the use of KIO and assessing its network exposure is crucial for understanding potential risks to

NVD modified: NVD date unavailable

A critical SQL injection vulnerability exists in TRtek's Store application, potentially allowing attackers to manipulate database queries. If reachable, this could lead to unauthorized access or modification of sensitive data. Determining the presence and exposure of this technology is crucial.

NVD modified: NVD date unavailable

A critical vulnerability in an ERP system exposes repository information via a publicly accessible .git directory. An unauthenticated remote attacker could exploit this by accessing the directory to retrieve metadata and files, potentially reconstructing the application's source code. This could lead to the exposure of

NVD modified: NVD date unavailable

A critical vulnerability in an ERP system's API endpoint allows unauthenticated remote attackers to access sensitive user information by manipulating parameters, bypassing authentication and authorization controls. This could lead to the exposure of other users' data.

NVD modified: NVD date unavailable

An ERP system vulnerability allows unauthenticated remote attackers to upload arbitrary files through an API, potentially leading to arbitrary code execution and system compromise. This issue is relevant if the API is reachable.

NVD modified: NVD date unavailable

Internal bugs in Mozilla Thunderbird and Firefox may lead to memory corruption. While exploitation is presumed possible with significant effort, the relevance and exposure of these applications require confirmation to assess potential risks.

NVD modified: NVD date unavailable

Memory corruption bugs in Thunderbird and Firefox could allow for exploitation if reachable. While exploitation is presumed difficult, the potential for memory corruption warrants attention to confirm relevance and exposure in your environment.

NVD modified: NVD date unavailable

A critical vulnerability exists in the graphics image processing component of Firefox and Thunderbird. An integer overflow could allow an attacker to execute remote code by processing a crafted image, potentially impacting data and system availability. It is important to determine if affected software is in use.

NVD modified: NVD date unavailable

A site isolation vulnerability exists in the DOM: Navigation component of Firefox and Thunderbird, potentially allowing attackers to compromise data confidentiality, integrity, and availability if triggered. The relevance and reachability of this issue should be confirmed.

NVD modified: NVD date unavailable

A critical vulnerability in Firefox Focus for Android could allow remote attackers to compromise application integrity, availability, and sensitive data. This issue has been fixed in a later version.

NVD modified: NVD date unavailable

A critical vulnerability exists in the Profile Backup component of Mozilla Firefox and Thunderbird that could allow unauthorized access to sensitive user data if reachable. The exact impact and exposure within your environment require further confirmation.

NVD modified: NVD date unavailable

A critical site isolation vulnerability exists in the DOM: Push Subscriptions component of Mozilla Firefox and Thunderbird. This issue could allow an attacker to access sensitive information or affect service behavior if a user interacts with malicious content. The relevance and exposure to your environment need to be

NVD modified: NVD date unavailable

A site isolation flaw in the DOM: Navigation component of Firefox and Thunderbird could allow remote attackers to compromise data. While fixed in recent versions, it's important to confirm if your environment uses affected software to understand potential exposure and impact on user data.

NVD modified: NVD date unavailable

A use-after-free flaw exists in the browser's DOM security component, allowing a sandbox escape if reachable. Exploitation requires users to visit malicious content, potentially leading to system compromise. Verifying user exposure and business criticality is essential.

NVD modified: NVD date unavailable

A use-after-free vulnerability in Firefox's DOM Navigation component allows for a sandbox escape. If reachable, this could impact confidentiality, integrity, and availability. It is important to determine the relevance and exposure of this vulnerability within our environment.

NVD modified: NVD date unavailable

An incorrect access control vulnerability exists in TOTOLINK networking equipment that allows unauthenticated attackers to emit indirect mesh heartbeat information via a crafted MQTT message. This could expose internal network signals and affect router communication. Readers should confirm relevance and understand pote

NVD modified: NVD date unavailable

An unauthenticated attacker can exploit a mesh configuration synchronization vulnerability in TOTOLINK devices by sending a crafted MQTT message. This could allow them to force configuration synchronization from an attacker-controlled host, potentially impacting network behavior and configuration.

NVD modified: NVD date unavailable

An incorrect access control vulnerability in TOTOLINK T6 routers allows unauthenticated attackers to disable guest Wi-Fi interfaces via a crafted MQTT message, potentially disrupting network services. Confirmation is needed to determine if this technology is in use and poses a relevant exposure.

NVD modified: NVD date unavailable

An unauthenticated remote attacker can erase diagnostic logs on TOTOLINK devices by sending a crafted POST request. This could hinder troubleshooting and obscure system activity. The relevance depends on whether the devices are internet-facing.

NVD modified: NVD date unavailable

A critical SQL injection vulnerability in Teracity E-OSB could allow unauthorized access to or modification of sensitive data if reachable. This threat impacts systems that process data through E-OSB, requiring an assessment of its presence and exposure within the environment.

NVD modified: NVD date unavailable

LibreNMS contains a stored cross-site scripting vulnerability in its Oxidized integration, where crafted JSON data from an attacker-controlled URL can execute malicious scripts within the device configuration page, impacting all users who view it. This requires administrator configuration of the integration to a malici

NVD modified: NVD date unavailable

A critical vulnerability exists in the Nokri WordPress theme, allowing unauthenticated attackers to take over any user account, including administrators, via an insecure password reset function. This could lead to complete website compromise and data control.

NVD modified: NVD date unavailable

Kyverno's TLS endpoints, when configured with specific older cipher suites, are vulnerable to the Sweet32 attack, potentially allowing an attacker to recover small amounts of plaintext over long, high-traffic connections. This issue is fixed in updated versions.

NVD modified: NVD date unavailable

A critical vulnerability in Lutece Core's XSL export management allows authenticated administrators to remotely execute code by uploading a malicious XSL stylesheet. This can occur if the system's XML/XSLT processing is not secured, leading to arbitrary code execution on the server during user export operations. This i

NVD modified: NVD date unavailable

A service in affected products has a Time-of-Check Time-of-Use race condition that an unauthenticated remote attacker could exploit to bypass security controls, potentially resulting in unauthorized code execution. The specific products and services affected are not detailed, so their relevance to your environment is u

NVD modified: NVD date unavailable

A critical vulnerability exists in a WordPress plugin that handles cookie consent, allowing unauthenticated attackers to upload arbitrary files to the server. This could lead to remote code execution, compromising server security. Confirm if this plugin is in use and assess its exposure.

NVD modified: NVD date unavailable

A critical OS command injection vulnerability in Plesk for Linux allows authenticated users with shell access to escalate privileges to root. This could lead to a full compromise of the hosting server environment.

NVD modified: NVD date unavailable