https://vulnogram.org/ Most recent CVEs assigned by Mandiant Inc. (mandiant). https://vulnogram.org/seaview/icons/mandiant.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-105044 https://vulnogram.org/CVE-2026-105044 Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Security Platform (Host Monitoring) V3.0 allows an authenticated console administrator to execute arbitrary comma… High Wed, 21 Oct 2026 01:02:23 GMT https://vulnogram.org/CVE-2026-114198 https://vulnogram.org/CVE-2026-114198 Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the floss utility High Wed, 21 Oct 2026 00:39:47 GMT https://vulnogram.org/CVE-2026-114197 https://vulnogram.org/CVE-2026-114197 Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a crafted .viv or .exe.viv workspace is passed to the capa utility High Wed, 21 Oct 2026 00:39:40 GMT https://vulnogram.org/CVE-2026-55396 https://vulnogram.org/CVE-2026-55396 Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows adjacent unauthenticated attackers to intercept, hija… High Thu, 01 Oct 2026 19:59:39 GMT https://vulnogram.org/CVE-2026-55395 https://vulnogram.org/CVE-2026-55395 Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to access and reconfigure Teledyne FLIR PackBot and FirstLook robots running this softw… Critical Thu, 01 Oct 2026 19:59:32 GMT https://vulnogram.org/CVE-2026-55394 https://vulnogram.org/CVE-2026-55394 Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this software via sniffi… Medium Thu, 01 Oct 2026 19:59:27 GMT https://vulnogram.org/CVE-2026-55393 https://vulnogram.org/CVE-2026-55393 Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attackers to read configuration and security parameters on Teledyne FLIR PackBot and FirstLook r… Critical Network Exploitable Thu, 01 Oct 2026 19:59:20 GMT https://vulnogram.org/CVE-2026-14984 https://vulnogram.org/CVE-2026-14984 Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, hijack, or modify session traffic against Teledyne FLIR PackBot robots running this softwar… Critical Thu, 01 Oct 2026 19:59:08 GMT https://vulnogram.org/CVE-2026-14983 https://vulnogram.org/CVE-2026-14983 Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of service against Teledyne FLIR PackBot robots running this software via misuse of the reboot endp… High Thu, 01 Oct 2026 19:59:00 GMT https://vulnogram.org/CVE-2025-9211 https://vulnogram.org/CVE-2025-9211 Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting Medium Tue, 18 Aug 2026 18:25:51 GMT https://vulnogram.org/CVE-2025-9210 https://vulnogram.org/CVE-2025-9210 Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs High Tue, 18 Aug 2026 18:25:47 GMT https://vulnogram.org/CVE-2026-71880 https://vulnogram.org/CVE-2026-71880 Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection High Tue, 18 Aug 2026 17:56:54 GMT https://vulnogram.org/CVE-2026-71879 https://vulnogram.org/CVE-2026-71879 Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass Critical Network Exploitable Tue, 18 Aug 2026 17:41:48 GMT https://vulnogram.org/CVE-2026-71878 https://vulnogram.org/CVE-2026-71878 Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication by… Critical Network Exploitable Tue, 18 Aug 2026 17:41:34 GMT https://vulnogram.org/CVE-2026-5426 https://vulnogram.org/CVE-2026-5426 Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState validation mechanisms and achieve remote code execution via malicious ViewState deserializ… Critical Network Exploitable Thu, 16 Apr 2026 15:18:46 GMT https://vulnogram.org/CVE-2025-57796 https://vulnogram.org/CVE-2025-57796 Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords and system configurations. This approach allows stored values to be decrypted offline if the… Medium Wed, 28 Jan 2026 17:47:56 GMT https://vulnogram.org/CVE-2025-57795 https://vulnogram.org/CVE-2025-57795 Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, this flaw can be leveraged to achieve remote code execution. Critical Wed, 28 Jan 2026 17:43:08 GMT https://vulnogram.org/CVE-2025-57794 https://vulnogram.org/CVE-2025-57794 Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does not adequately restrict uploaded file types, allowing malicious files to be uploaded and ex… Critical Wed, 28 Jan 2026 17:33:43 GMT https://vulnogram.org/CVE-2025-57792 https://vulnogram.org/CVE-2025-57792 Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An attacker can supply crafted input that is executed as part of backend database queries. T… Critical Network Exploitable Wed, 28 Jan 2026 17:26:51 GMT https://vulnogram.org/CVE-2025-57793 https://vulnogram.org/CVE-2025-57793 Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application component. Crafted input can be executed as part of backend database queries. The issue is ex… High Network Exploitable Wed, 28 Jan 2026 17:09:49 GMT https://vulnogram.org/CVE-2025-12480 https://vulnogram.org/CVE-2025-12480 Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete. Critical Known Exploited Network Exploitable Mon, 10 Nov 2025 14:20:40 GMT https://vulnogram.org/CVE-2025-4665 https://vulnogram.org/CVE-2025-4665 WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insecure deserialization (PHP Object Injection). The weakness arises due to insufficient valida… Critical Network Exploitable Tue, 28 Oct 2025 23:54:29 GMT https://vulnogram.org/CVE-2025-2172 https://vulnogram.org/CVE-2025-2172 Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing command injection via special characters in filenames Medium Mon, 23 Jun 2025 14:01:19 GMT https://vulnogram.org/CVE-2025-2171 https://vulnogram.org/CVE-2025-2171 Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force guess the 6-digit password reset PIN High Network Exploitable Mon, 23 Jun 2025 14:01:07 GMT https://vulnogram.org/CVE-2024-12442 https://vulnogram.org/CVE-2024-12442 EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access. Critical Network Exploitable Fri, 09 May 2025 13:55:20 GMT https://vulnogram.org/CVE-2024-11861 https://vulnogram.org/CVE-2024-11861 EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access. Critical Network Exploitable Fri, 09 May 2025 13:51:37 GMT https://vulnogram.org/CVE-2023-6080 https://vulnogram.org/CVE-2023-6080 Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows contains a local privilege escalation vulnerability which allows attackers SYSTEM level access. High Fri, 18 Oct 2024 16:09:48 GMT https://vulnogram.org/CVE-2024-6586 https://vulnogram.org/CVE-2024-6586 Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contains HTML elements which point to a threat actor controlled source can trigger an SSRF reque… High Fri, 30 Aug 2024 22:25:48 GMT https://vulnogram.org/CVE-2024-6585 https://vulnogram.org/CVE-2024-6585 Multiple stored cross-site scripting (“XSS”) vulnerabilities in the markdown dashboard and dashboard comment functionality of Lightdash version 0.1024.6 allows remote authenticated threat actors to inject malicious scripts into vulnerable web pages.… Medium Fri, 30 Aug 2024 22:17:28 GMT https://vulnogram.org/CVE-2023-4472 https://vulnogram.org/CVE-2023-4472 Objectplanet Opinio version 7.22 and prior uses a cryptographically weak pseudo-random number generator (PRNG) coupled to a predictable seed, which could lead to an unauthenticated account takeover of any user on the application. Critical Network Exploitable Thu, 01 Feb 2024 22:11:21 GMT https://vulnogram.org/CVE-2023-7102 https://vulnogram.org/CVE-2023-7102 Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection.This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vuln… Sun, 24 Dec 2023 21:47:20 GMT https://vulnogram.org/CVE-2023-7101 https://vulnogram.org/CVE-2023-7101 Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Speci… High Known Exploited Sun, 24 Dec 2023 21:34:46 GMT