|
2811
|
7.5 |
HIGH
Network
|
senselive
|
x3500_firmware
|
A vulnerability in SenseLive X3050’s management ecosystem allows unauthenticated discovery of deployed units through the vendor’s management protocol, enabling identification of device presence, iden…
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-35064
|
2026-04-29 04:33 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2812
|
9.8 |
CRITICAL
Network
|
senselive
|
x3500_firmware
|
A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rath…
|
CWE-798
Use of Hard-coded Credentials
|
CVE-2026-35503
|
2026-04-29 04:33 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2813
|
5.3 |
MEDIUM
Network
|
senselive
|
x3500_firmware
|
A vulnerability exists in SenseLive X3050’s web management interface due to its reliance on unencrypted HTTP for all administrative communication. Because management traffic, including authentication…
|
CWE-319
Cleartext Transmission of Sensitive Information
|
CVE-2026-40431
|
2026-04-29 04:33 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2814
|
9.8 |
CRITICAL
Network
|
senselive
|
x3500_firmware
|
A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive config appli…
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-40620
|
2026-04-29 04:32 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2815
|
9.1 |
CRITICAL
Network
|
senselive
|
x3500_firmware
|
A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentication or server-side validation. By apply…
|
CWE-306
Missing Authentication for Critical Function
|
CVE-2026-27843
|
2026-04-29 04:32 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2816
|
8.1 |
HIGH
Network
|
senselive
|
x3500_firmware
|
A vulnerability in SenseLive X3050's web management interface allows state-changing operations to be triggered without proper Cross-Site Request Forgery (CSRF) protections. Because the application do…
|
CWE-352
Origin Validation Error
|
CVE-2026-27841
|
2026-04-29 04:32 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2817
|
5.4 |
MEDIUM
Network
|
senselive
|
x3500_firmware
|
A vulnerability exists in SenseLive
X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requi…
|
CWE-613
Insufficient Session Expiration
|
CVE-2026-25720
|
2026-04-29 04:31 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2818
|
5.9 |
MEDIUM
Network
|
opentelemetry
|
opentelemetry
|
OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on …
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-41078
|
2026-04-29 04:24 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2819
|
7.5 |
HIGH
Network
|
sqlalchemy
|
mako
|
Mako is a template library written in Python. Prior to 1.3.11, TemplateLookup.get_template() is vulnerable to path traversal when a URI starts with // (e.g., //../../../secret.txt). The root cause is…
|
CWE-22
Path Traversal
|
CVE-2026-41205
|
2026-04-29 04:14 |
2026-04-24 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
2820
|
4.7 |
MEDIUM
Local
|
linux
|
linux_kernel
|
In the Linux kernel, the following vulnerability has been resolved:
smb: client: make use of smbdirect_socket.recv_io.credits.available
The logic off managing recv credits by counting posted recv_i…
|
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
|
CVE-2026-31535
|
2026-04-29 04:14 |
2026-04-25 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
