Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102760 | not reported | — | No | When NetX Secure is built with `NX_SECURE_KEY_CLEAR`, every TLS record sent on an active session is wiped after it has been handed to TCP. B... | 2026-09-29 |
| CVE-2026-102759 | not reported | — | No | NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a de... | 2026-09-29 |
| CVE-2026-102712 | not reported | — | No | On the first DTLS ClientHello, the parser copies a device-claimed session_id length and validates the ciphersuite-list length against the t... | 2026-09-29 |
| CVE-2026-102711 | not reported | — | No | Two issues in the ThreadX loadable-module loader, reached when a device loads an attacker-controlled module object via `_txm_module_manager_... | 2026-09-29 |
| CVE-2026-100299 | medium | 6.8 | No | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the device includes a legacy password hash on the serial console that relies on a weak D... | 2026-09-29 |
| CVE-2026-100298 | high | 8.8 | No | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, two user‑information endpoints can reveal sensitive device and account details under con... | 2026-09-29 |
| CVE-2026-100297 | medium | 5.3 | No | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an unauthenticated network check function can be triggered to probe arbitrary hosts from... | 2026-09-29 |
| CVE-2026-100296 | high | 8.1 | No | In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4, an empty-body POST to /setUserConfig, dispatched through the web server's SOAP-RPC handl... | 2026-09-29 |
| CVE-2026-100295 | medium | 6.3 | No | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, an internal debug interface can be enabled through an undocumented pathway, exposing fun... | 2026-09-29 |
| CVE-2026-100294 | high | 7.5 | No | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, the firmware embeds hardcoded cloud‑API credentials that are shared across deployed devi... | 2026-09-29 |
| CVE-2026-100293 | high | 8.8 | No | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, both the local and cloud update mechanisms apply new firmware without any cryptographic... | 2026-09-29 |
| CVE-2026-100292 | high | 8.8 | No | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, a hidden debug interface can be enabled through an authenticated request, allowing addit... | 2026-09-29 |
| CVE-2026-100291 | critical | 9.8 | No | In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4, several ONVIF service endpoints process management requests without enforcing required a... | 2026-09-29 |
| CVE-2026-102830 | medium | 6.8 | No | JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From Jupyter... | 2026-09-29 |
| CVE-2026-8067 | medium | 6.5 | No | An improper authorization vulnerability in the end-of-life versions of RTU500’s web application allows an authenticated user to trigger the... | 2026-09-29 |
| CVE-2026-8066 | critical | 9.1 | No | A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated... | 2026-09-29 |
| CVE-2026-8065 | critical | 9.1 | No | An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticat... | 2026-09-29 |
| CVE-2026-7395 | not reported | — | No | Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to... | 2026-09-29 |
| CVE-2026-76720 | medium | 4.3 | No | A vulnerability in HPE OneView can be remotely exploited to cause a URL redirect. | 2026-09-29 |
| CVE-2026-76719 | high | 8.2 | No | A security vulnerability in HPE OneView may be exploited remotely to perform session hijacking, data theft or other unauthorized actions. | 2026-09-29 |