{"items":[{"id":"CVE-2026-29128","published":"2026-03-05T05:12:35.774Z","updated":"2026-03-05T17:22:34.882Z","title":"IDC SFX2100 Satellite Receiver bgpd/ospfd/ripd/zebra Config Credential Disclosure via World-Readable Files","severity":"HIGH","score":8.6,"vendor":"International Datacasting Corporation","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.00284,"kevAdded":null,"exploit":true},{"id":"CVE-2026-29127","published":"2026-03-05T02:36:12.112Z","updated":"2026-03-05T17:26:12.994Z","title":"Incorrect Permission Assignment(777) on `monitor` Users Home Directory Containing SUID Root Binaries in IDC SFX2100","severity":"CRITICAL","score":9.2,"vendor":"International Datacasting Corporation","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.00186,"kevAdded":null,"exploit":true},{"id":"CVE-2026-29126","published":"2026-03-05T01:51:06.378Z","updated":"2026-03-05T16:59:33.634Z","title":"World-Writable, Root Owned/Run `/etc/udhcpc/default.script` in IDC SFX2100 Satellite Receiver Leads To Potential LPE","severity":"HIGH","score":8.5,"vendor":"International Datacasting Corporation","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.00161,"kevAdded":null,"exploit":true},{"id":"CVE-2026-29125","published":"2026-03-05T01:38:18.502Z","updated":"2026-03-05T16:38:06.199Z","title":"IDC SFX2100 Satellite Receiver allows unprivileged modification of DNS configuration due to world-writable `/etc/resolv.conf`","severity":"HIGH","score":7.1,"vendor":"International Datacasting Corporation","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.0012,"kevAdded":null,"exploit":false},{"id":"CVE-2026-29124","published":"2026-03-05T01:23:35.863Z","updated":"2026-03-05T16:38:43.548Z","title":"Multiple SUID Root Binaries in `monitor` User Home Directory Leading to Potential Local Privilege Escalation","severity":"HIGH","score":8.6,"vendor":"International Datacasting Corporation","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.00136,"kevAdded":null,"exploit":false},{"id":"CVE-2026-29123","published":"2026-03-05T01:18:58.502Z","updated":"2026-03-05T16:39:49.783Z","title":"Multiple SUID Root Binaries in `xd` User Home Directory Leading to Potential Local Privilege Escalation","severity":"HIGH","score":8.6,"vendor":"International Datacasting Corporation","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.00145,"kevAdded":null,"exploit":false},{"id":"CVE-2026-29122","published":"2026-03-05T00:53:24.429Z","updated":"2026-03-05T16:41:24.667Z","title":"`/bin/date` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE","severity":"HIGH","score":8.3,"vendor":"International Datacasting Corporation","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.00158,"kevAdded":null,"exploit":false},{"id":"CVE-2026-29121","published":"2026-03-05T00:48:59.825Z","updated":"2026-03-06T18:22:54.833Z","title":"`/sbin/ip` Binary given SETUID Permissions on IDC SFX2100 Leading to Potential LPE","severity":"HIGH","score":8.3,"vendor":"International Datacasting Corporation","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.00169,"kevAdded":null,"exploit":false},{"id":"CVE-2026-29120","published":"2026-03-04T08:10:09.223Z","updated":"2026-03-05T05:56:21.420Z","title":"Insecure, Hardcoded Root Password Stored in Anaconda Configuration File On IDC SFX2100 Satellite Receiver","severity":"CRITICAL","score":9.2,"vendor":"International Datacasting Corporation","product":"IDC SFX2100 SuperFlex Satellite Receiver","kev":false,"epss":0.00162,"kevAdded":null,"exploit":false},{"id":"CVE-2026-29119","published":"2026-03-04T07:58:16.199Z","updated":"2026-03-05T05:58:16.802Z","title":"Hardcoded and Insecure Credentials for \"Admin\" Account providing Telnet Access on IDC SFX2100 Satellite Receiver","severity":"HIGH","score":8.8,"vendor":"International Datacasting Corporation (IDC)","product":"SFX2100 Series SuperFlex SatelliteReceiver","kev":false,"epss":0.00553,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28778","published":"2026-03-04T07:49:10.824Z","updated":"2026-03-05T05:58:40.991Z","title":"Hardcoded FTP Credentials and LPE(via Insecure Permissions) for `xd` Local Account on IDC SFX2100","severity":"HIGH","score":7.9,"vendor":"International Datacasting Corporation (IDC)","product":"IDC SFX2100 SuperFlex Satellite Receiver","kev":false,"epss":0.00935,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28777","published":"2026-03-04T07:41:29.280Z","updated":"2026-03-05T05:58:56.851Z","title":"Hardcoded and Insecure Credentials for \"User\" Local Account with SSH Access On IDC SFX2100 Satellite Receiver","severity":"CRITICAL","score":9.2,"vendor":"International Datacasting Corporation (IDC)","product":"SFX2100 Satellite Receiver","kev":false,"epss":0.00553,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28776","published":"2026-03-04T07:34:30.681Z","updated":"2026-03-05T05:59:08.518Z","title":"Hardcoded and Insecure Credentials for \"monitor\" account with SSH Access On IDC SFX2100 Satellite Receiver","severity":"HIGH","score":7.8,"vendor":"International Datacasting Corporation (IDC)","product":"IDC SFX2100 SuperFlex Satellite Receiver","kev":false,"epss":0.00553,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28775","published":"2026-03-04T07:24:50.693Z","updated":"2026-03-05T05:59:25.113Z","title":"Unauthenticated RCE via SNMP Default Writable Community String","severity":"CRITICAL","score":10,"vendor":"International Datacasting Corporation (IDC)","product":"SFX2100 Series SuperFlex SatelliteReceiver","kev":false,"epss":0.01232,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28774","published":"2026-03-04T07:22:57.677Z","updated":"2026-03-05T05:59:55.331Z","title":"Authenticated OS Command Injection via Traceroute Utility leads to Root RCE","severity":"CRITICAL","score":9.3,"vendor":"International Datacasting Corporation (IDC)","product":"SFX Series SuperFlex SatelliteReceiver Web Management Interface","kev":false,"epss":0.02764,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28773","published":"2026-03-04T07:16:58.715Z","updated":"2026-03-05T06:00:17.350Z","title":"Authenticated OS Command Injection via Ping Utility Leading to RCE as Root","severity":"CRITICAL","score":9.3,"vendor":"International Datacasting Corporation (IDC)","product":"SFX Series SuperFlex SatelliteReceiver Web Management Interface","kev":false,"epss":0.02374,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28772","published":"2026-03-04T07:12:53.143Z","updated":"2026-03-05T06:00:30.449Z","title":"Reflected XSS in IDC_Logging Index endpoint","severity":"MEDIUM","score":5.1,"vendor":"International Datacasting Corporation (IDC)","product":"SFX Series SuperFlex SatelliteReceiver Web Management Interface","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28771","published":"2026-03-04T07:11:36.743Z","updated":"2026-03-05T06:00:45.803Z","title":"Reflected XSS In /index.cgi Endpoint On IDC Satellite Receiver Web Management Interface Version 101","severity":"MEDIUM","score":5.1,"vendor":"International Datacasting Corporation (IDC)","product":"SFX Series SuperFlex Satellite Receiver Web Management Interface","kev":false,"epss":0.00245,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28770","published":"2026-03-04T07:06:35.477Z","updated":"2026-03-05T06:01:02.877Z","title":"XML injection In /IDC_Logging/checkifdone.cgi Endpoint On IDC SFX Web Management Interface Version 101","severity":"MEDIUM","score":5.3,"vendor":"International Datacasting Corporation (IDC)","product":"SFX Series SuperFlex Satellite Receiver Web management interface","kev":false,"epss":0.00417,"kevAdded":null,"exploit":false},{"id":"CVE-2026-28769","published":"2026-03-04T07:02:13.741Z","updated":"2026-03-05T05:58:29.757Z","title":"LFI in /IDC_Logging/checkifdone.cgi, \"file\" parameter Allowing for File Existence Enumeration On IDC Satellite Receiver Web Management Interface Version 101","severity":"MEDIUM","score":5.3,"vendor":"International Datacasting Corporation (IDC)","product":"SFX Series SuperFlex Satellite Receiver Web management interface","kev":false,"epss":0.00658,"kevAdded":null,"exploit":false},{"id":"CVE-2026-1953","published":"2026-02-05T06:33:02.766Z","updated":"2026-02-05T14:36:07.433Z","title":"Stored Cross Site Scripting(XSS) in Nukegraphic CMS V3.1.2","severity":"HIGH","score":8.2,"vendor":"Nukegraphic CMS","product":"Nukegraphic CMS","kev":false,"epss":0.00468,"kevAdded":null,"exploit":true},{"id":"CVE-2025-14202","published":"2025-12-17T23:35:17.515Z","updated":"2025-12-18T15:33:47.895Z","title":"Cross-Site Request Forgery (CSRF) Leading to Account Takeover via SVG File Upload","severity":"HIGH","score":8.2,"vendor":"Linkding","product":"LinkDing","kev":false,"epss":0.0028,"kevAdded":null,"exploit":false},{"id":"CVE-2025-66269","published":"2025-11-26T01:19:18.496Z","updated":"2025-11-26T14:30:14.483Z","title":"Unquoted Service Path in UPSilon2000V6.0(RupsMon and USBMate) running as SYSTEM","severity":"HIGH","score":7.1,"vendor":"MegaTec Taiwan","product":"UPSilon2000V6.0","kev":false,"epss":0.00126,"kevAdded":null,"exploit":false},{"id":"CVE-2025-66266","published":"2025-11-26T01:16:40.731Z","updated":"2025-11-26T15:28:25.062Z","title":"Insecure SYSTEM Service Permissions in UPSilon2000V6.0 (RupsMon.exe) leading to trivial Local Privilege Escalation","severity":"CRITICAL","score":9.3,"vendor":"MegaTec Taiwan","product":"UPSilon2000V6.0","kev":false,"epss":0.00146,"kevAdded":null,"exploit":false},{"id":"CVE-2025-66265","published":"2025-11-26T01:12:50.505Z","updated":"2025-11-26T15:31:02.065Z","title":"Insecure permissions in configuration directory (C:\\\\usr)","severity":"MEDIUM","score":6.9,"vendor":"MegaTec Taiwan","product":"ClientMate","kev":false,"epss":0.00122,"kevAdded":null,"exploit":false},{"id":"CVE-2025-66264","published":"2025-11-26T01:09:51.506Z","updated":"2025-11-26T16:09:51.264Z","title":"Unquoted Service path in UPSilon2000V6.0 SYSTEM privilege service","severity":"HIGH","score":7.2,"vendor":"MegaTec Taiwan","product":"ClientMate","kev":false,"epss":0.00126,"kevAdded":null,"exploit":false},{"id":"CVE-2025-66263","published":"2025-11-26T00:52:24.390Z","updated":"2025-11-26T16:10:21.364Z","title":"Unauthenticated Arbitrary File Read via Null Byte Injection","severity":"HIGH","score":8.9,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00421,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66262","published":"2025-11-26T00:50:55.913Z","updated":"2025-11-26T14:57:11.139Z","title":"Arbitrary File Overwrite via Tar Extraction Path Traversal","severity":"CRITICAL","score":9.3,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.01527,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66261","published":"2025-11-26T00:49:38.259Z","updated":"2025-11-26T15:00:02.948Z","title":"Unauthenticated OS Command Injection (restore_settings.php)","severity":"CRITICAL","score":9.9,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.02302,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66260","published":"2025-11-26T00:48:34.554Z","updated":"2025-11-26T15:06:21.454Z","title":"PostgreSQL SQL Injection (status_sql.php)","severity":"HIGH","score":7.2,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00328,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66259","published":"2025-11-26T00:46:51.931Z","updated":"2025-11-26T15:46:56.051Z","title":"Authenticated Root Remote Code Execution through improper filtering of HTTP post request parameters","severity":"CRITICAL","score":9.3,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00707,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66258","published":"2025-11-26T00:45:39.995Z","updated":"2025-11-26T15:47:46.259Z","title":"Stored Cross-Site Scripting via XML Injection","severity":"HIGH","score":7.1,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00206,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66257","published":"2025-11-26T00:43:54.408Z","updated":"2025-11-26T15:49:25.857Z","title":"Unauthenticated Arbitrary File Deletion (patch_contents.php)","severity":"CRITICAL","score":9.2,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00411,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66256","published":"2025-11-26T00:41:08.666Z","updated":"2025-12-03T16:13:49.513Z","title":"Unauthenticated Arbitrary File Upload (patch_contents.php)","severity":"CRITICAL","score":9.9,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00469,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66255","published":"2025-11-26T00:39:56.984Z","updated":"2025-12-03T16:00:07.473Z","title":"Unauthenticated Arbitrary File Upload (upgrade_contents.php)","severity":"CRITICAL","score":9.9,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00406,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66254","published":"2025-11-26T00:37:48.788Z","updated":"2025-12-03T15:55:50.204Z","title":"Unauthenticated Arbitrary File Deletion (upgrade_contents.php)","severity":"HIGH","score":7.8,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00411,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66253","published":"2025-11-26T00:36:29.474Z","updated":"2025-12-03T15:55:18.897Z","title":"Unauthenticated OS Command Injection (start_upgrade.php)","severity":"CRITICAL","score":9.9,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.02302,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66252","published":"2025-11-26T00:34:11.994Z","updated":"2025-12-01T21:11:46.724Z","title":"Infinite Loop Denial of Service via Failed File Deletion","severity":"HIGH","score":8.4,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00389,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66251","published":"2025-11-26T00:32:26.142Z","updated":"2025-11-26T15:03:03.656Z","title":"Unauthenticated Path Traversal with Arbitrary File Deletion","severity":"HIGH","score":7.7,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00523,"kevAdded":null,"exploit":true},{"id":"CVE-2025-66250","published":"2025-11-26T00:29:57.431Z","updated":"2025-11-26T14:56:59.781Z","title":"Unauthenticated Arbitrary File Upload (status_contents.php)","severity":"CRITICAL","score":9.2,"vendor":"DB Electronica Telecomunicazioni S.p.A.","product":"Mozart FM Transmitter","kev":false,"epss":0.00469,"kevAdded":null,"exploit":true},{"id":"CVE-2025-12683","published":"2025-11-04T04:23:02.884Z","updated":"2025-11-04T20:50:21.977Z","title":"NULL DACL assigned to Named Pipe communicating with SYSTEM Service","severity":"MEDIUM","score":5.8,"vendor":"Voidtools","product":"Everything","kev":false,"epss":0.00099,"kevAdded":null,"exploit":false},{"id":"CVE-2025-1131","published":"2025-09-23T04:31:02.784Z","updated":"2026-02-26T17:48:19.381Z","title":"Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation","severity":"HIGH","score":7,"vendor":"Asterisk","product":"Asterisk","kev":false,"epss":0.00218,"kevAdded":null,"exploit":true},{"id":"CVE-2025-2271","published":"2025-03-13T06:30:03.130Z","updated":"2025-03-13T20:43:33.084Z","title":"IDOR in Issuetrak NewAuditID parameter via Inv_PopTrakXShow.asp","severity":"HIGH","score":7.7,"vendor":"issuetrak","product":"audit","kev":false,"epss":0.00331,"kevAdded":null,"exploit":false},{"id":"CVE-2025-1135","published":"2025-02-19T09:01:59.048Z","updated":"2025-02-19T14:55:42.227Z","title":"SQL Injection in ChurchCRM CurrentFundraiser Parameter via BatchWinnerEntry.php","severity":"CRITICAL","score":9.3,"vendor":"ChurchCRM","product":"ChurchCRM","kev":false,"epss":0.00759,"kevAdded":null,"exploit":true},{"id":"CVE-2025-1134","published":"2025-02-19T08:58:08.847Z","updated":"2025-02-19T15:02:45.629Z","title":"SQL Injection in ChurchCRM CurrentFundraiser Parameter via DonatedItemEditor.php","severity":"CRITICAL","score":9.3,"vendor":"ChurchCRM","product":"ChurchCRM","kev":false,"epss":0.00759,"kevAdded":null,"exploit":true},{"id":"CVE-2025-1133","published":"2025-02-19T08:52:43.000Z","updated":"2025-02-19T15:03:53.926Z","title":"SQL Injection in ChurchCRM EID Parameter via EditEventAttendees.php","severity":"CRITICAL","score":9.3,"vendor":"ChurchCRM","product":"ChurchCRM","kev":false,"epss":0.00631,"kevAdded":null,"exploit":true},{"id":"CVE-2025-1132","published":"2025-02-19T08:47:13.370Z","updated":"2025-02-19T15:05:57.942Z","title":"SQL Injection in ChurchCRM EN_tyid Parameter via EditEventAttendees.php","severity":"CRITICAL","score":9.3,"vendor":"ChurchCRM","product":"ChurchCRM","kev":false,"epss":0.0058,"kevAdded":null,"exploit":true},{"id":"CVE-2025-1024","published":"2025-02-19T08:34:55.967Z","updated":"2025-02-19T19:40:43.255Z","title":"Session Hijacking via Reflected Cross-Site Scripting (XSS) in ChurchCRM EditEventAttendees.php EID Parameter","severity":"HIGH","score":8.4,"vendor":"ChurchCRM","product":"ChurchCRM","kev":false,"epss":0.0029,"kevAdded":null,"exploit":true},{"id":"CVE-2025-1023","published":"2025-02-18T09:45:26.188Z","updated":"2025-02-18T14:27:27.899Z","title":"SQL Injection in ChurchCRM newCountName Parameter via EditEventTypes.php","severity":"CRITICAL","score":9.3,"vendor":"ChurchCRM","product":"ChurchCRM","kev":false,"epss":0.02455,"kevAdded":null,"exploit":true},{"id":"CVE-2025-0981","published":"2025-02-18T09:33:54.210Z","updated":"2025-02-19T08:37:46.688Z","title":"Session Hijacking via Stored Cross-Site Scripting (XSS) in ChurchCRM GroupEditor.php Description Field","severity":"HIGH","score":8.4,"vendor":"ChurchCRM","product":"ChurchCRM","kev":false,"epss":0.00218,"kevAdded":null,"exploit":true},{"id":"CVE-2024-12123","published":"2024-12-04T03:26:00.918Z","updated":"2024-12-04T14:09:11.911Z","title":"Unauthorized Modification of Ticket Requester","severity":"MEDIUM","score":5.3,"vendor":"Issuetrak","product":"Issuetrak","kev":false,"epss":0.00376,"kevAdded":null,"exploit":false},{"id":"CVE-2024-11479","published":"2024-12-04T00:23:39.944Z","updated":"2024-12-04T14:49:43.102Z","title":"Authenticated HTML Injection in Issuetrak Ticket Comment Function","severity":"MEDIUM","score":5.1,"vendor":"Issuetrak","product":"Issuetrak","kev":false,"epss":0.0039,"kevAdded":null,"exploit":false}]}