آخرین آسیب‌پذیری‌ها

EmpireSoft EmpireCMS index.php cross site scripting

On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi credentials via the USB interface. Sensitive data within the firmware configuration can be abused to gain root…

In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific scenarios, which may be exploited by attackers to achieve remote code execution.

InfiniFlow RAGFlow Images API file_utils.py cross site scripting

In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK with insufficient strength is used. Attackers can exploit this weakness via brute-force attacks to gain…

DataGerry < 3.3.0 SSTI via DocAPI Template Rendering

Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X PEAP network configuration function. This flaw exposes deployed 802.1X network access authenticatio…

InfiniFlow RAGFlow Seafile Connector seafile_connector.py _account_get server-side request forgery

Symfony: ScopingHttpClient Sends the Credentials of Its Default Scope to Other Origins Through Network-Path References

BIG-HKSCS decoding hang on crafted input

yezhihao jt808-server Web Management API WebMvcConfig.addInterceptors missing authentication

GetPaid WordPress Plugin < 2.8.63 Negative Quantity Payment Bypass

GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API

Cisco Identity Services Engine Authorization Bypass Vulnerability

Cisco Unified Communications Manager Cross-Site Scripting Vulnerability

Cisco Unified Computing System Central Remote Code Execution Vulnerability

jackson-dataformat-cbor: quadratic-time TagList growth on unbounded stacked tags (CPU/GC DoS, PoC)

APT RCE via hard link reuse

ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies

Coder before 2.29.22, 2.34.13, 2.35.10, 2.36.8, 2.37.5, and 2.38.1 AI Gateway Path Traversal

Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak

Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

FreeRDP before 3.32.2 Heap Buffer Overflow via rpc_client_recv_fragment

FreeRDP before 3.32.2 Use-After-Free via Dynamic rdpsnd Channel Close