tag
Cwe-306
Critical
Xiongmai XM530 IP Camera ONVIF Authentication Bypass (CVE-2025-65856)
CVE-2025-65856·
Xiongmai XM530-based IP camera ONVIF service (tested on model XM530_50X50-WG_8M)
unpatched
Critical
RustFS Hardcoded gRPC Authentication Token Leading to Full Node Compromise (CVE-2025-68926)
CVE-2025-68926·
RustFS (Rust-based S3-compatible distributed object storage) — internal node-to-node gRPC service
unpatched
Critical
CrushFTP AS2 Header Authentication Bypass (CVE-2025-54309)
CVE-2025-54309·
CrushFTP server, AS2 (Applicability Statement 2) authentication module / web admin interface
patched
Critical
Cibeles AI `actualizador_git.php` Unauthenticated Arbitrary File Upload / RCE (CVE-2025-13595)
CVE-2025-13595·
Cibeles AI (WordPress plugin)
unpatched
Critical
AI Feeds `actualizador_git.php` Unauthenticated Arbitrary File Upload / RCE (CVE-2025-13597)
CVE-2025-13597·
AI Feeds (WordPress plugin)
unpatched
High
OpenCode Unauthenticated Local HTTP Server -> Remote Code Execution (CVE-2026-22812)
CVE-2026-22812 (GHSA-vxw4-wv6m-9hhh)·
OpenCode (AI developer/coding agent tool) local HTTP server
patched
Critical
MeiG Smart FORGE_SLT711 GoAhead Unauthenticated OS Command Injection (CVE-2026-36356)
CVE-2026-36356·
MeiG Smart FORGE_SLT711 4G LTE CPE (GoAhead web server)
unpatched
Critical
Flowise NVIDIA NIM Endpoint Authentication Bypass — CVE-2026-30824
CVE-2026-30824·
Flowise (NVIDIA NIM integration endpoints)
unpatched
High
Chamilo LMS Unauthenticated install.ajax.php SSRF + Open Mail Relay — CVE-2026-33715
CVE-2026-33715 / GHSA-mxc9-9335-45mc·
Chamilo LMS 2.0
unpatched