https://vulnogram.org/ Most recent CVEs assigned by Toreon (toreon). https://vulnogram.org/seaview/icons/toreon.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-9177 https://vulnogram.org/CVE-2026-9177 A Server-Side Template Injection (SSTI) vulnerability was identified in the mail template functionality of the Axway SecureTransport product in version 5.5-20260326. This flaw allows an attacker with admin privileges to inject arbitrary Java code exp… Critical Wed, 29 Jul 2026 13:46:06 GMT https://vulnogram.org/CVE-2026-12527 https://vulnogram.org/CVE-2026-12527 A broken authorization boundary in the RTSP media delivery pipeline of Shenzhen Liandian Communication Technology LTD V380 IP Camera firmware AppFHE1_V1.0.6.020230803 enables unauthenticated network actors to bypass the device’s credential-enforced l… Medium Thu, 18 Jun 2026 13:55:41 GMT https://vulnogram.org/CVE-2026-4255 https://vulnogram.org/CVE-2026-4255 A DLL search order hijacking vulnerability in Thermalright TR-VISION HOME on Windows (64-bit) allows a local attacker to escalate privileges via DLL side-loading. The application loads certain dynamic-link library (DLL) dependencies using the default… High Mon, 16 Mar 2026 07:14:07 GMT https://vulnogram.org/CVE-2025-12642 https://vulnogram.org/CVE-2025-12642 lighttpd1.4.80 incorrectly merged trailer fields into headers after http request parsing. This behavior can be exploited to conduct HTTP Header Smuggling attacks. Successful exploitation may allow an attacker to: * Bypass access control rules * Injec… Medium Network Exploitable Mon, 03 Nov 2025 19:36:17 GMT https://vulnogram.org/CVE-2025-9709 https://vulnogram.org/CVE-2025-9709 On-Chip Debug and Test Interface With Improper Access Control and Improper Protection against Electromagnetic Fault Injection (EM-FI) in Nordic Semiconductor nRF52810 allow attacker to perform EM Fault Injection and bypass APPROTECT at runtime, requi… High Fri, 05 Sep 2025 17:16:16 GMT https://vulnogram.org/CVE-2025-7202 https://vulnogram.org/CVE-2025-7202 A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles the victim's lights. Medium Network Exploitable Wed, 06 Aug 2025 08:28:23 GMT https://vulnogram.org/CVE-2025-7503 https://vulnogram.org/CVE-2025-7503 An OEM IP camera manufactured by Shenzhen Liandian Communication Technology LTD exposes a Telnet service (port 23) with undocumented, default credentials. The Telnet service is enabled by default and is not disclosed or configurable via the device’s… Critical Network Exploitable Fri, 11 Jul 2025 18:53:24 GMT https://vulnogram.org/CVE-2025-7346 https://vulnogram.org/CVE-2025-7346 Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages High Network Exploitable Tue, 08 Jul 2025 07:05:11 GMT https://vulnogram.org/CVE-2025-6563 https://vulnogram.org/CVE-2025-6563 A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protocol in the `dst` parameter. When the victim browses to the malicious URL and logs in, the XSS… Medium Thu, 03 Jul 2025 11:18:26 GMT