CWE-940

TouchLink packets processed after timeout or out of range due to Operation on a Resource after Expiration and Missing Release of Resource after Effective Lifetime may allow a device to be added outside of valid TouchLink range or pairing duration This issue affects Ember ZNet 7.1.x from 7.1.3 through 7.1.5; 7.2.x from 7.2.0 through 7.2.3; Version 7.3 and later are unaffected

Podatność w oprogramowaniu Caterease firmy Horizon Business Services Inc. umożliwia zdalnemu atakującemu przeprowadzenie ataku typu Traffic Injection. Wynika ona z nieprawidłowej weryfikacji źródła kanału komunikacyjnego, co przy ocenie CVSS 9.8 czyni ją zagrożeniem krytycznym.

Podatność w routerze Tenda AX2 Pro umożliwia zdalnemu atakującemu wykonanie dowolnego kodu bez uwierzytelnienia. Ocena CVSS 9.8 wskazuje na krytyczny poziom zagrożenia — urządzenie może zostać całkowicie przejęte przez sieć.

Chunghwa Telecom NOKIA G-040W-Q Firewall function has a vulnerability of input validation for ICMP redirect messages. An unauthenticated remote attacker can exploit this vulnerability by sending a crafted package to modify the network routing table, resulting in a denial of service or sensitive information leaking.

MLflow w wersji 3.9.0 zawiera błąd nieprawidłowej walidacji origin (CWE-346) w endpointach /ajax-api funkcji MLflow Assistant. Podatność umożliwia zdalnemu atakującemu wykonanie dowolnych poleceń na lokalnej maszynie ofiary poprzez spreparowaną stronę internetową.

SillyTavern w wersjach przed 1.13.4 jest podatny na atak DNS rebinding, który pozwala atakującemu na wykonywanie nieautoryzowanych akcji w interfejsie użytkownika. Zagrożenie jest poważne, ponieważ atakujący może instalować złośliwe rozszerzenia, odczytywać historię czatów oraz wstrzykiwać dowolny kod HTML w celach phishingowych.

Aplikacja electerm, będąca klientem terminal/SSH/SFTP/Telnet/RDP/VNC i innych protokołów, zawiera krytyczną podatność w wersjach od 3.0.6 do 3.8.8. Podatność oceniona na CVSS 9.3 może pozwolić lokalnemu atakującemu na przejęcie kontroli nad systemem i powiązanymi zasobami.

Gematik Authenticator w wersjach wcześniejszych niż 4.16.0 jest podatny na authentication flow hijacking, który umożliwia atakującemu uwierzytelnienie się tożsamością ofiary. Podatność jest krytyczna, ponieważ dotyczy aplikacji służącej do bezpiecznego logowania do cyfrowych aplikacji zdrowotnych.

Podatność w Lanscope Endpoint Manager (On-Premises) pozwala nieuwierzytelnionemu atakującemu na zdalne wykonanie dowolnego kodu poprzez wysłanie spreparowanych pakietów sieciowych. Jest aktywnie wykorzystywana w atakach, co nadaje jej najwyższy priorytet reakcji.

An issue in H3C Technologies Co., Limited H3C Magic RC3000 RC3000V100R009 allows a remote attacker to execute arbitrary code via the Routing functionality.

TAIWAN-CA(TWCA) JCICSecurityTool fails to check the source website and access locations when executing multiple Registry-related functions. In the scenario where a user is using the JCICSecurityTool and has completed identity verification, if the user browses a malicious webpage created by an attacker, the attacker can exploit this vulnerability to read or modify any registry file under HKEY_CURRENT_USER, thereby achieving remote code execution.

In CODESYS Development System versions from 3.5.11.20 and before 3.5.19.20 a missing integrity check might allow an unauthenticated remote attacker to manipulate the content of notifications received via HTTP by the CODESYS notification server.

Easy Chat Server 3.1 contains a denial of service vulnerability that allows remote attackers to crash the application by sending oversized data in the message parameter. Attackers can establish a session via the chat.ghp endpoint and then send a POST request to body2.ghp with an excessively large message parameter value to cause the service to crash.

Affected products do not properly enforce TCP sequence number validation in specific scenarios but accept values within a broad range. This could allow an unauthenticated remote attacker e.g. to interfere with connection setup, potentially leading to a denial of service. The attack succeeds only if an attacker can inject IP packets with spoofed addresses at precisely timed moments, and it affects only TCP-based services.

OpenClaw before 2026.3.22 contains an unvalidated WebView JavascriptInterface vulnerability allowing attackers to inject arbitrary instructions. Untrusted pages can invoke the canvas bridge to execute malicious code within the Android application context.

An issue was discovered in Deepin dde-api-proxy through 1.0.19 in which unprivileged users can access D-Bus services as root. Specifically, dde-api-proxy runs as root and forwards messages from arbitrary local users to legacy D-Bus methods in the actual D-Bus services, and the actual D-Bus services don't know about the proxy situation (they believe that root is asking them to do things). Consequently several proxied methods, that shouldn't be accessible to non-root users, are accessible to non-root users. In situations where Polkit is involved, the caller would be treated as admin, resulting in a similar escalation of privileges.

Element Android is an Android Matrix Client. Element Android version 1.4.3 through 1.6.10 is vulnerable to intent redirection, allowing a third-party malicious application to start any internal activity by passing some extra parameters. Possible impact includes making Element Android display an arbitrary web page, executing arbitrary JavaScript; bypassing PIN code protection; and account takeover by spawning a login screen to send credentials to an arbitrary home server. This issue is fixed in Element Android 1.6.12. There is no known workaround to mitigate the issue.

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.4.1 for iOS and 2026.4.4 for Android, he Home Assistant Companion apps for Android and iOS expose a JavaScript bridge to the in-app WebView window.externalApp on Android and webkit.messageHandlers.getExternalAuth (alongside revokeExternalAuth and externalBus) on iOS. Two flaws expose the bridge to all frames (including cross-origin iframes) and unsanitized interpolation of the JavaScript callback identifier allows a cross-origin iframe rendered inside the Companion app to execute arbitrary JavaScript in the Home Assistant frontend's main-frame origin and exfiltrate the signed-in user's access token. This vulnerability is fixed in 2026.4.1 for iOS and 2026.4.4 for Android.

The registration process of uniFLOW Online (NT-ware product) apps, prior to and including version 2024.1.0, can be compromised when email login is enabled on the tenant. Those tenants utilising email login in combination with Microsoft Safe Links or similar are impacted. This vulnerability may allow the attacker to register themselves against a genuine user in the system and allow malicious users with similar access and capabilities via the app to the existing genuine user.

Anviz CrossChex Standard lacks source verification in the client/server channel, enabling TCP packet injection by an attacker on the same network to alter or disrupt application traffic.