CVE-2026-82645

AVideo Unauthenticated Stream Credential Disclosure via Forgeable Token

AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the plugin/Live/view/Live_restreams/getLiveKey.json.php endpoint. Supplying a 'token' request parameter waives both the Live::canRestream() access gate and the restream ownership check, causing the endpoint to return any restream's stream_key and stream_url (credentials for external platforms such as YouTube, Facebook, and Twitch) without authentication. The token is merely encryptString() of an integer id with no user binding, expiry, or authentication tag. Because encryption uses AES-256-CBC with a deterministic IV and no MAC, and because intval() accepts any string beginning with a digit, an unauthenticated attacker can forge valid tokens using the public encryption oracle in view/url2Embed.json.php, disclosing arbitrary users' stream credentials.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-82592

D-Link DIR-825M Disk Formatting Handler Endpoint formDiskFormat sub_46725C stack-based overflow

A vulnerability was detected in D-Link DIR-825M 1.1.8. This affects the function sub_46725C of the file /boafrm/formDiskFormat of the component Disk Formatting Handler Endpoint. The manipulation of the argument partition results in stack-based buffer overflow. The attack can be executed remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS < 1% KEV · Not listed

Vendors

D-link

Products

Dir-825m

CVE-2026-82689

D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 ISO Image isomount_mgr.cgi os command injection

A vulnerability was detected in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected is an unknown function of the file /cgi-bin/isomount_mgr.cgi of the component ISO Image Handler. The manipulation of the argument upIsoRootPath results in os command injection. The attack can be executed remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.3% KEV · Not listed

Vendors

D-link

Products

Dns-320l Dns-327l Dns-340l and 1 more

CVE-2026-73125

Ebyte NA111-M Missing Authentication for Critical Function

Ebyte device web management interface does not consistently enforce authentication before granting access to administrative functionality. An unauthenticated remote attacker could access sensitive configuration information, modify device settings, or disrupt availability.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ebyte

Products

Ebyte Ne2-d11 Firmware

CVE-2026-76179

Ebyte NA111-M Use of GET Request Method With Sensitive Query Strings

An improper protection of authentication tokens vulnerability exists in certain Ebyte gateway products. Authentication tokens used by the web management interface are insufficiently protected during client-side session handling, which may allow an attacker with access to exposed session information to obtain and reuse a valid token. Successful exploitation could allow an attacker to impersonate an authenticated user and gain unauthorized access to device management functionality.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ebyte

Products

Ebyte Ne2-d11 Firmware

CVE-2026-71187

Ebyte NA111-M Use of Client-Side Authentication

The Ebyte device relies on client side authentication logic that can be reproduced by unauthenticated users. An attacker may generate valid authentication requests and bypass authentication to obtain administrative access to the device.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ebyte

Products

Ebyte Ne2-d11 Firmware

CVE-2026-69658

Ebyte NA111-M Cleartext Transmission of Sensitive Information

MQTT credentials and control traffic are transmitted in cleartext, exposing sensitive information to network-level attackers. This may enable unauthorized device impersonation and disruption of messaging functions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Ebyte

Products

Ebyte Ne2-d11 Firmware

CVE-2026-0826

Poly Voice – Possible Remote Control of Certain Poly Devices

In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

CVSS 4.0 · 9.2 Critical EPSS 32.2% KEV · Not listed

Vendors

Hp Inc.

Products

Poly Trio 8300 Poly Trio 8500 Poly Trio 8800 and 1 more

CVE-2026-82860

@hulumi/policies before 1.3.2 Admin Policy Bypass

@hulumi/policies versions before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hulumi

Products

Policies

CVE-2026-82695

Tenda AC18 Telnet telnet missing authentication

A security flaw has been discovered in Tenda AC18 15.03.05.19. Impacted is an unknown function of the file /goform/telnet of the component Telnet Handler. The manipulation results in missing authentication. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 10 Critical EPSS 1.4% KEV · Not listed

Vendors

Tenda

Products

Ac18 Ac18 Firmware

CVE-2026-82692

D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi_mgr.cgi. Performing a manipulation of the argument alias/username/password/volume_location results in os command injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.4 Critical EPSS 3.3% KEV · Not listed

Vendors

D-link

Products

Dns-340l Dns-345

CVE-2026-82690

D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve_mgr.cgi. This manipulation of the argument f_dev causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 9.4 Critical EPSS 3.6% KEV · Not listed

Vendors

D-link

Products

Dns-327l Dns-340l

CVE-2026-82628

Colorful iGameCenter IOCTL Dispatch WinRing0x64.sys sub_11504 privileges management

A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a requirement.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Colorful

Products

Igamecenter

CVE-2026-82858

@hulumi/drift before 1.3.2 Unsafe Execute Plan Acceptance

@hulumi/drift versions before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Hulumi

Products

Drift

CVE-2026-81098

Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they were absent, so a request without any credential completed initialisation and dispatched tools. Dispatch forwarded the server's own stored credentials, the Telnyx API key and client secret together with the code-execution key, to the upstream endpoint, so an unauthenticated caller able to reach the port acted with them. The current code defaults the host to loopback, requires a server API key, and enforces it in middleware.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Telnyx

Products

Telnyx-mcp

CVE-2026-78207

exceljs through 4.4.0 Prototype Pollution via deepMerge Reached From Note Serialization

exceljs through 4.4.0 contains a prototype pollution vulnerability in the deepMerge helper that fails to reject __proto__, constructor, or prototype keys when merging note objects. Attackers can assign parsed JSON with a malicious __proto__ property to cell notes, modifying Object.prototype and affecting all plain objects created in the process.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Exceljs Project

Products

Exceljs

CVE-2026-74820

Unauthenticated SQL Injection via Dynamic Schema ORDER BY Clause

ServiceNow has remediated a SQL injection vulnerability that was identified in in the ServiceNow AI platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to execute arbitrary SQL statements against the instance's underlying database and gain access to, or modify, instance data beyond what was intended.  ServiceNow deployed a security update to hosted instances and ServiceNow provided the update to our partners and self-hosted customers. We are not currently aware of malicious exploitation against ServiceNow instances.  We recommend customers promptly apply appropriate updates or upgrade to a patched release if they have not already done so.

CVSS 4.0 · 10 Critical EPSS 5.1% KEV · Not listed

Vendors

Servicenow

Products

Servicenow Ai Platform

CVE-2026-65956

KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management operations can be reached without administrator authorization. Because reading, creating, and updating the global SSO configuration is not restricted to administrators, an unauthorized or low-privileged user can inspect or alter the authentication configuration, which under certain conditions can lead to account takeover or privilege escalation. The SSO connectivity-test function can additionally be abused as a server-side request forgery primitive, and the user list API returns user objects without consistently clearing authentication-related fields. This issue is fixed in version 2.0.0.

CVSS 4.0 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

1panel Dev

Products

Kubepi

CVE-2026-80203

Grav before 1.0.18 Authentication Bypass via Scoped API Key

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-80104

DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skill_upload in packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/agentic_data_api.py takes file.filename as given and writes the request body to upload_dir / filename. A path composed with that operator discards the left operand when the right one is absolute and follows parent references otherwise, so a filename such as ../../../tmp/x or /tmp/x resolves outside the intended directory; nothing canonicalises the result, checks that it remains under the upload root, or prevents a .py suffix. The route's only dependency is get_user_from_headers in dbgpt_serve/utils/auth.py, which returns a request carrying the admin role whether or not a user_id header is supplied, so the endpoint is reachable without credentials. A remote attacker holding no account can therefore write attacker-controlled bytes to any path the server process can write, place a new Python module inside the application package or replace one the application already imports, and obtain code execution in the server process when that module is next imported.

CVSS 4.0 · 9.3 Critical EPSS 1.1% KEV · Not listed

Vendors

Dbgpt Eosphoros-ai

Products

Db-gpt Db-gpt