<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" href="rss.xsl"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>VULSec Labs — recent CVEs</title>
    <link>https://vulnogram.org/</link>
    <atom:link href="https://vulnogram.org/rss/vulsec" rel="self" type="application/rss+xml"/>
    <description>Most recent CVEs assigned by VULSec Labs (vulsec).</description>
    <image>
      <url>https://vulnogram.org/seaview/icons/vulsec.png</url>
      <title>VULSec Labs — recent CVEs</title>
      <link>https://vulnogram.org/</link>
    </image>
    <lastBuildDate>Wed, 21 Oct 2026 07:00:07 GMT</lastBuildDate>
    <item>
      <title>CVE-2026-30785 · 8.2 HIGH — RustDesk Encrypts Local Passwords with World-Readable Machine ID and Fixed Zero Nonce (XSalsa20-Poly1305)</title>
      <link>https://vulnogram.org/CVE-2026-30785</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30785</guid>
      <description>Improperly Controlled Modification of Object Prototype Attributes (&apos;Prototype Pollution&apos;), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS, Linux (Pas…</description>
      <category>High</category>
      <pubDate>Thu, 05 Mar 2026 16:04:36 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30783 · 4.8 MEDIUM — RustDesk Client Can Orphan API Channel to Ignore All Admin Commands and ACL Policies</title>
      <link>https://vulnogram.org/CVE-2026-30783</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30783</guid>
      <description>A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Client signaling, API sync loop, config management modules) allows Privilege Abuse. This vulnerability is associated with program fi…</description>
      <category>Medium</category>
      <pubDate>Thu, 05 Mar 2026 15:52:21 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30789 · 5.7 MEDIUM — RustDesk Auth Proof Uses Server-Controlled Salt/Challenge and Fast Double-SHA256, Enabling Offline Brute-Force</title>
      <link>https://vulnogram.org/CVE-2026-30789</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30789</guid>
      <description>Use of Password Hash With Insufficient Computational Effort, Improper Restriction of Excessive Authentication Attempts vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Client login, peer authent…</description>
      <category>Medium</category>
      <pubDate>Thu, 05 Mar 2026 15:41:51 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30798 · 8.2 HIGH 🌩️ — RustDesk Client Accepts Unauthenticated stop-service Command via Strategy Payload</title>
      <link>https://vulnogram.org/CVE-2026-30798</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30798</guid>
      <description>Insufficient Verification of Data Authenticity, Improper Handling of Exceptional Conditions vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop, strategy processing modules) all…</description>
      <category>High</category>
      <category>Network Exploitable</category>
      <pubDate>Thu, 05 Mar 2026 15:38:49 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30797 · 9.3 CRITICAL 🌩️ — RustDesk rustdesk://config/ URI Silently Re-homes Client to Attacker-Controlled Server</title>
      <link>https://vulnogram.org/CVE-2026-30797</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30797</guid>
      <description>Missing Authorization vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, config import modules) allows Application API Message Manipulation via Man-in-the-Middle. This…</description>
      <category>Critical</category>
      <category>Network Exploitable</category>
      <pubDate>Thu, 05 Mar 2026 15:35:08 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30796 · 6.9 MEDIUM 🌩️ — RustDesk Client Transmits Preset Address Book Password Verbatim in Heartbeat Sync</title>
      <link>https://vulnogram.org/CVE-2026-30796</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30796</guid>
      <description>Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Address book sync, Heartbeat sync loop modules) allows Snif…</description>
      <category>Medium</category>
      <category>Network Exploitable</category>
      <pubDate>Thu, 05 Mar 2026 15:30:39 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30795 · 8.7 HIGH 🌩️ — RustDesk HTTP Client Silently Accepts Invalid TLS Certificates After Handshake Failure</title>
      <link>https://vulnogram.org/CVE-2026-30795</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30795</guid>
      <description>Cleartext Transmission of Sensitive Information vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Heartbeat sync loop modules) allows Sniffing Attacks. This vulnerability is associated with progr…</description>
      <category>High</category>
      <category>Network Exploitable</category>
      <pubDate>Thu, 05 Mar 2026 15:27:16 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30793 · 9.3 CRITICAL 🌩️ — RustDesk Flutter URI Handler Sets Permanent Password Without Privilege Check or User Confirmation</title>
      <link>https://vulnogram.org/CVE-2026-30793</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30793</guid>
      <description>Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android (Flutter URI scheme handler, FFI bridge modules) allows Privilege Escalation. This vulnerability is associated w…</description>
      <category>Critical</category>
      <category>Network Exploitable</category>
      <pubDate>Thu, 05 Mar 2026 15:21:03 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30792 · 8.3 HIGH 🌩️ — RustDesk Client Blindly Merges Unauthenticated Strategy Payloads, Bypassing Local Security Settings</title>
      <link>https://vulnogram.org/CVE-2026-30792</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30792</guid>
      <description>A vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Strategy sync, HTTP API client, config options engine modules) allows Application API Message Manipulation via Man-in-the-Middle. Th…</description>
      <category>High</category>
      <category>Network Exploitable</category>
      <pubDate>Thu, 05 Mar 2026 15:14:43 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-30791 · 8.7 HIGH 🌩️ — RustDesk Client Accepts Pseudo-Encrypted Config Strings Without Cryptographic Validation</title>
      <link>https://vulnogram.org/CVE-2026-30791</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-30791</guid>
      <description>Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Linux, iOS, Android, WebClient (Config import, URI scheme handler, CLI --config modules) allows Retrieve Embedded Sen…</description>
      <category>High</category>
      <category>Network Exploitable</category>
      <pubDate>Thu, 05 Mar 2026 14:47:56 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2026-3598 · 8.7 HIGH 🌩️ — RustDesk Server Generates Config Strings Using Reversible Encoding (Base64 + Reverse) Instead of Encryption</title>
      <link>https://vulnogram.org/CVE-2026-3598</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2026-3598</guid>
      <description>Use of a Broken or Risky Cryptographic Algorithm vulnerability in rustdesk-server-pro RustDesk Server Pro rustdesk-server-pro on Windows, MacOS, Linux (Config string generation, web console export modules) allows Retrieve Embedded Sensitive Data. Thi…</description>
      <category>High</category>
      <category>Network Exploitable</category>
      <pubDate>Thu, 05 Mar 2026 14:14:11 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52271 · 8.2 HIGH 💥 — PDF Document Spoofing in Documenso</title>
      <link>https://vulnogram.org/CVE-2024-52271</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52271</guid>
      <description>User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -&gt; Examine the print previ…</description>
      <category>High</category>
      <category>Known Exploited</category>
      <pubDate>Thu, 05 Dec 2024 13:56:08 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52270 · 8.2 HIGH 💥 ☁️ — PDF Document Spoofing in DropBox Sign(HelloSign)</title>
      <link>https://vulnogram.org/CVE-2024-52270</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52270</guid>
      <description>User Interface (UI) Misrepresentation of Critical Information vulnerability in DropBox Sign(HelloSign) allows Content Spoofing. Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -&gt; Examine…</description>
      <category>High</category>
      <category>Known Exploited</category>
      <category>Cloud Hosted</category>
      <pubDate>Thu, 05 Dec 2024 10:55:30 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52269 · 8.2 HIGH 💥 🌩️ ☁️ — AI Assistant PDF Document Spoofing in DocuSign</title>
      <link>https://vulnogram.org/CVE-2024-52269</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52269</guid>
      <description>User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. The SaaS AI assistant ignores hidden content that is rendered after signing, misleading the user. For reference see: CVE-2024-52276 This…</description>
      <category>High</category>
      <category>Known Exploited</category>
      <category>Network Exploitable</category>
      <category>Cloud Hosted</category>
      <pubDate>Wed, 04 Dec 2024 11:25:45 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52275 · 8.3 HIGH — Denial of Service on Tenda AC6V2 Due To Stack Overflow</title>
      <link>https://vulnogram.org/CVE-2024-52275</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52275</guid>
      <description>Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromWizardHandle modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50.</description>
      <category>High</category>
      <pubDate>Wed, 04 Dec 2024 10:20:15 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52274 · 8.3 HIGH — Denial of Service on Tenda AC6V2 Due To Stack Overflow</title>
      <link>https://vulnogram.org/CVE-2024-52274</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52274</guid>
      <description>Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoubleL2tpConfig-&gt;guest_ip_check(overflow arg: mask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50</description>
      <category>High</category>
      <pubDate>Wed, 04 Dec 2024 10:19:57 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52273 · 8.3 HIGH — Denial of Service on Tenda AC6V2 Due To Stack Overflow</title>
      <link>https://vulnogram.org/CVE-2024-52273</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52273</guid>
      <description>Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (setDoublePppoeConfig-&gt;guest_ip_check(overflow arg: mask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50</description>
      <category>High</category>
      <pubDate>Wed, 04 Dec 2024 10:19:27 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52272 · 8.3 HIGH — Denial of Service on Tenda AC6V2 Due To Stack Overflow</title>
      <link>https://vulnogram.org/CVE-2024-52272</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52272</guid>
      <description>Stack-based Buffer Overflow vulnerability in Shenzhen Tenda Technology Co Tenda AC6V2 (fromAdvSetLanip(overflow arg:lanMask) modules) allows Overflow Buffers.This issue affects Tenda AC6V2: through 15.03.06.50</description>
      <category>High</category>
      <pubDate>Wed, 04 Dec 2024 10:18:05 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52277 · 8.2 HIGH 💥 — PDF Document Spoofing in DocuSeal</title>
      <link>https://vulnogram.org/CVE-2024-52277</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52277</guid>
      <description>User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSeal allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -&gt; Examine the print previe…</description>
      <category>High</category>
      <category>Known Exploited</category>
      <pubDate>Wed, 04 Dec 2024 10:16:26 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52276 · 8.2 HIGH 💥 🌩️ ☁️ — PDF Document Spoofing in DocuSign</title>
      <link>https://vulnogram.org/CVE-2024-52276</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52276</guid>
      <description>User Interface (UI) Misrepresentation of Critical Information vulnerability in DocuSign allows Content Spoofing. 1. Displayed version does not show the layer flattened version, which is provided when the &quot;Print&quot; option is used. 2. Displayed version d…</description>
      <category>High</category>
      <category>Known Exploited</category>
      <category>Network Exploitable</category>
      <category>Cloud Hosted</category>
      <pubDate>Wed, 04 Dec 2024 10:13:06 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2024-52043 · 6.9 MEDIUM 🌩️ — User enumeration in HubHub</title>
      <link>https://vulnogram.org/CVE-2024-52043</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2024-52043</guid>
      <description>Generation of Error Message Containing Sensitive Information in HumHub GmbH &amp; Co. KG - HumHub on Linux allows: Excavation (user enumeration).This issue affects all released HumHub versions: through 1.16.2.</description>
      <category>Medium</category>
      <category>Network Exploitable</category>
      <pubDate>Wed, 06 Nov 2024 07:51:17 GMT</pubDate>
    </item>
    <item>
      <title>CVE-2023-40735 · 7.5 HIGH 🌩️ — Butterfly Button Project - Sensitive Information Disclosure</title>
      <link>https://vulnogram.org/CVE-2023-40735</link>
      <guid isPermaLink="true">https://vulnogram.org/CVE-2023-40735</guid>
      <description>Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Cavo – Connecting for a Safer World BUTTERFLY BUTTON (Architecture flaw) allows loss of plausible deniability and confidentiality.This issue affects BUTTERFLY BUTTON: As of 2…</description>
      <category>High</category>
      <category>Network Exploitable</category>
      <pubDate>Mon, 21 Aug 2023 11:35:44 GMT</pubDate>
    </item>
  </channel>
</rss>
