CVE Database
29323 results
| CVE ID | Severity | CVSS | Description | MITRE TTPs | Flags | Published |
|---|---|---|---|---|---|---|
| CVE-2026-77061 | NONE | — | boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated rem… |
T1078
T1548
|
|
2026-10-26 |
| CVE-2026-77060 | NONE | — | boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd w… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-77059 | NONE | — | boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in b… |
T1068
T1134
|
|
2026-10-26 |
| CVE-2026-77058 | NONE | — | boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints … |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-77057 | NONE | — | boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH se… |
T1190
T1059
+1
|
|
2026-10-26 |
| CVE-2026-77056 | NONE | — | boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-77055 | NONE | — | boneIO black_debian_images gives the boneio service account excessive privileges, including full pas… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-77054 | NONE | — | boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartext. The … |
T1078
T1548
|
|
2026-10-26 |
| CVE-2026-77053 | NONE | — | boneIO Black firmware ships with authentication disabled by default. Its management web API listens … |
T1078
T1548
|
|
2026-10-26 |
| CVE-2026-77052 | NONE | — | boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Cadd… |
T1190
T1059
+1
|
|
2026-10-26 |
| CVE-2026-65184 | CRITICAL | 9.8 | The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied We… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-3322 | NONE | — | Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-36698 | NONE | — | Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an O… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-31158 | NONE | — | SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attac… |
T1190
T1059
+1
|
|
2026-10-26 |
| CVE-2026-116497 | MEDIUM | 5.5 | A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-116340 | MEDIUM | 4.3 | A vulnerability was identified in iFlytek astron-agent up to 1.1.2. This impacts the function FileIn… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-116339 | HIGH | 7.3 | A vulnerability was determined in iFlytek astron-agent up to 1.1.2. This affects an unknown function… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-116284 | MEDIUM | 4.3 | A security vulnerability has been detected in Kameleo up to 5.3.1. This vulnerability affects unknow… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-115930 | MEDIUM | 6.8 | The MongoDB Shell (mongosh) relies on Node.js as a third-party runtime that carries its own TLS root… |
T1190
T1203
|
|
2026-10-26 |
| CVE-2026-112345 | HIGH | 8.1 | TTLock Android application before v9.8.260718 and associated smart-lock firmware contain a hardcoded… |
T1190
T1203
|
|
2026-10-26 |