Mandiant

Latest CVEs · RSS

• CVE-2026-55396 2026-10-01 · CVSS 8.5
  Cleartext transmission without a cryptographic integrity check in operator control unit to robot UDP traffic in Teledyne FLIR Aware2 versions through 6.9.0.2 (P
• CVE-2026-55395 2026-10-01 · CVSS 9.4
  Hardcoded passwords in the access control in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attacke
• CVE-2026-55394 2026-10-01 · CVSS 5.3
  Unencrypted traffic in the 802.11 network of Teledyne FLIR Aware2 versions through 6.9.0.2 allows adjacent unauthenticated attackers to intercept, hijack, or mo
• CVE-2026-55393 2026-10-01 · CVSS 10.0
  Unvalidated pathnames in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 (PackBot) and 1.7.9 (FirstLook) allows remote unauthenticated attack
• CVE-2026-14984 2026-10-01 · CVSS 9.4
  Cleartext transmission in the primary control endpoints of Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to intercept, h
• CVE-2026-14983 2026-10-01 · CVSS 7.1
  Missing authentication in the web interface in Teledyne FLIR Aware2 versions through 6.9.0.2 allows remote unauthenticated attackers to achieve denial of servic
• CVE-2025-9211 2026-08-18 · CVSS 6.7
  Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate
• CVE-2025-9210 2026-08-18 · CVSS 8.1
  Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate priv
• CVE-2026-71880 2026-08-18 · CVSS 7.6
  Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access
• CVE-2026-71879 2026-08-18 · CVSS 9.1
  Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote
• CVE-2026-71878 2026-08-18 · CVSS 9.2
  Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4
• CVE-2026-5426 2026-04-16
  Hard-coded ASP.NET/IIS machineKey value in Digital Knowledge KnowledgeDeliver deployments prior to February 24, 2026 allows adversaries to circumvent ViewState
• CVE-2025-57796 2026-01-28
  Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords an
• CVE-2025-57795 2026-01-28
  Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, thi
• CVE-2025-57794 2026-01-28
  Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does n
• CVE-2025-57792 2026-01-28
  Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. An
• CVE-2025-57793 2026-01-28
  Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application com
• CVE-2025-12480 2025-11-10 · CVSS 9.1
  Triofox versions prior to 16.7.10368.56560, are vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is comp
• CVE-2025-4665 2025-10-28 · CVSS 9.6
  WordPress plugin Contact Form CFDB7 versions up to and including 1.3.2 are affected by a pre-authentication SQL injection vulnerability that cascades into insec
• CVE-2025-2172 2025-06-23 · CVSS 6.6
  Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 fail to sanitize user input prior to passing the input to command line utilities, allowing c
• CVE-2025-2171 2025-06-23 · CVSS 7.8
  Aviatrix Controller versions prior to 7.1.4208, 7.2.5090, and 8.0.0 do not enforce rate limiting on password reset attempts, allowing adversaries to brute force
• CVE-2024-12442 2025-05-09
  EnerSys AMPA versions 24.04 through 24.16, inclusive, are vulnerable to command injection leading to privileged remote shell access.
• CVE-2024-11861 2025-05-09
  EnerSys AMPA 22.09 and prior versions are vulnerable to command injection leading to privileged remote shell access.
• CVE-2023-6080 2024-10-18
  Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows contains a local privilege escalation vulnerability which allows attackers SYSTEM lev
• CVE-2024-6586 2024-08-30
  Lightdash version 0.1024.6 allows users with the necessary permissions, such as Administrator or Editor, to create and share dashboards. A dashboard that contai