CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Oray Pugongying X5 Pro Router Improper Authorization Vulnerability (CVE-2026-120224)
[Affected Scope] Oray Pugongying X5 Pro router versions up to and including 7.6.1
[Impact] A restricted account can bypass authorization checks to remotely invoke sensitive administrative functions, such as a factory reset, via manipulated JSON batch API requests
[Mitigation] Restrict external access to the router's management interface and apply temporary access control lists (ACLs) until an official patch is released
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability (CVE-2023-22518) Security Advisory
[Affected Scope] All self-hosted versions of Confluence Data Center and Server. (Atlassian Cloud sites are not affected)
[Impact] Unauthenticated remote attackers can reset Confluence setup states and create unauthorized administrator accounts, leading to a complete compromise of confidentiality, integrity, and availability.
[Mitigation] Immediately upgrade to the latest patched versions or restrict external access to the setup endpoints (/setup/*) via reverse proxy or WAF configurations.
QNAP HBS 3 (Hybrid Backup Sync) Improper Authorization Vulnerability (CVE-2021-28799) Security Advisory
[Affected Scope] QNAP HBS 3 (Hybrid Backup Sync) running on QTS, QuTS hero, and QuTScloud operating systems
[Impact] Unauthenticated remote attackers can exploit improper authorization to log in to the device with administrative privileges, potentially leading to full system compromise
[Mitigation] Immediately update HBS 3 to the patched versions and restrict external internet access to the NAS management interface