CVEs published January 26, 2026

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) do not enforce rate limiting or account lockout mechanisms on authentication endpoints.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) ship with a predefined default password for a built-in authentication account that is not required to be changed during initial…

`Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed.

dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives).

AssertJ provides Fluent testing assertions for Java and the Java Virtual Machine (JVM).

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) allow account passwords to be changed through the maintenance interface without requiring verification of the existing password.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain an authorization flaw in the user management API that allows a low-privileged authenticated user to change the…

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

Single Sign-On Portal System developed by WellChoose has a OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and execute them on the server.

A flaw has been found in Tenda AC23 16.03.07.52.

When running Skipper as an Ingress controller, users with permissions to create an Ingress and a Service of type ExternalName can create routes that enable them to use Skipper's network access to reach…

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.

An Out-Of-Bounds Write vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an attacker to…

A Heap-based Buffer Overflow vulnerability affecting the EPRT file reading procedure in SOLIDWORKS eDrawings from Release SOLIDWORKS Desktop 2025 through Release SOLIDWORKS Desktop 2026 could allow an…

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) disclose sensitive account credentials in cleartext within HTTP responses generated by the maintenance interface.

Multiple denial of service vulnerabilities exist in React Server Components, affecting the following packages: react-server-dom-parcel, react-server-dom-turbopack, react-server-dom-webpack.

BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docker.setup_script`, `docker.dockerfile_template`, `conda.environment_yml`).

A flaw has been found in code-projects Online Music Site 1.0.

A vulnerability was found in code-projects Online Examination System 1.0.

A vulnerability has been found in Sangfor Operation and Maintenance Security Management System up to 3.0.12.

A flaw was found in gix-date.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) fail to include the X-Content-Type-Options: nosniff response header on web management interfaces.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) implement an insecure Cross-Origin Resource Sharing (CORS) policy on authenticated administrative endpoints.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) display stored user account passwords in plaintext within the administrative web interface.

When pnpm installs a `file:` (directory) or `git:` dependency, it follows symlinks and reads their target contents without constraining them to the package root.

A path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`.

A path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows.

A path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory.

A vulnerability was detected in Beetel 777VR1 up to 01.00.09/01.00.09_55.

A vulnerability was determined in code-projects Online Examination System 1.0.

A vulnerability was determined in Sangfor Operation and Maintenance Security Management System up to 3.0.12.

A vulnerability was found in Sangfor Operation and Maintenance Security Management System up to 3.0.12.

A flaw has been found in Beetel 777VR1 up to 01.00.09/01.00.09_55.

A security flaw has been discovered in pymumu SmartDNS up to 47.1.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) serve sensitive administrative content without appropriate cache-control directives.

When pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root.

Crafting a malicious tag which starting with `"` prematurely ends the `<input>` tag on the start page and allows an attacker to add arbitrary html leading to a possible XSS attack.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) contain a stored cross-site scripting vulnerability in the user creation functionality.

Single Sign-On Portal System developed by WellChoose has a Reflected Cross-site Scripting vulnerability, allowing authenticated remote attackers to execute arbitrary JavaScript codes in user's browser…

A security vulnerability has been detected in GPAC up to 2.4.0.

ArcGIS Pro is a desktop application, and exploitation is limited to local users interacting with the application; no privileged role or elevated permissions are required beyond standard local user access.

Tanium addressed an uncontrolled resource consumption vulnerability in Discover.

A vulnerability was found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c.

A vulnerability was identified in PHPGurukul News Portal 1.0.

A weakness has been identified in D-Link DCS700l 1.03.09.

Shenzhen Tenda W30E V2 firmware versions up to and including V16.01.0.19(5037) lack cross-site request forgery (CSRF) protections on administrative endpoints, including those used to change administrator…

It is possible to bypass the sequence state verification including authentication, and send requests that transition to forbidden states relative to the current one, thereby updating the current context…

Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.

A vulnerability has been found in code-projects Online Examination System 1.0.

A weakness has been identified in GPAC up to 2.4.0.

A security flaw has been discovered in GPAC up to 2.4.0.

A vulnerability was identified in GPAC up to 2.4.0.

A flaw was found in Keycloak's SAML brokering functionality.

Tanium addressed an improper input validation vulnerability in Discover.

A vulnerability has been found in iJason-Liu Books_Manager up to 298ba736387ca37810466349af13a0fdf828e99c.

A security vulnerability has been detected in Beetel 777VR1 up to 01.00.09/01.00.09_55.

The sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a parameter in the authentication request but the "state"…