{"resultsPerPage":3,"startIndex":0,"totalResults":3,"format":"NVD_CVE","version":"2.0","timestamp":"2026-08-05T14:29:09.925","vulnerabilities":[{"cve":{"id":"CVE-2026-0392","sourceIdentifier":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","published":"2026-08-03T10:16:27.747","lastModified":"2026-08-05T10:17:25.820","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"eParakstītājs 3.0 for Windows before version\n1.10.0 retrieves and executes its automatic updates over a channel that is not\nauthenticated or integrity-protected. On each launch the application fetches an\nupdate descriptor (XML) over TLS but accepts any TLS certificate (a permissive\nTrustManager and a HostnameVerifier that always returns true), does not verify\nany digital signature on the update descriptor, and does not verify the\nAuthenticode signature or a checksum of the downloaded installer before running\nit. A man-in-the-middle attacker able to redirect www.eparaksts.lv can serve a\ncrafted update descriptor pointing to an attacker-controlled executable, which\nthe client downloads and executes, resulting in arbitrary code execution on the\nvictim host."}],"affected":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","affectedData":[{"vendor":"Latvijas Valsts radio un televīzijas centrs (LVRTC)","product":"eParakstītājs 3.0","defaultStatus":"unaffected","platforms":["Windows"],"versions":[{"version":"0","lessThan":"1.10.0","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":7.3,"baseSeverity":"HIGH","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-03T10:35:21.949793Z","id":"CVE-2026-0392","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158","type":"Secondary","description":[{"lang":"en","value":"CWE-295"},{"lang":"en","value":"CWE-347"},{"lang":"en","value":"CWE-494"}]}],"references":[{"url":"https://cvd.cert.lv/inbox/view/vuln-all-1689187061","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},{"url":"https://offseq.com/en/research/eparakstitajs-cve-2026-0392/","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"},{"url":"https://www.eparaksts.lv/lv/par_mums/Jaunumi/Jauna_eParakstitajs_30_versija_1100","source":"a6d3dc9e-0591-4a13-bce7-0f5b31ff6158"}]}},{"cve":{"id":"CVE-2026-15452","sourceIdentifier":"security@wordfence.com","published":"2026-08-05T10:17:27.110","lastModified":"2026-08-05T10:17:27.110","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Query String in all versions up to, and including, 6.11.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}],"affected":[{"source":"security@wordfence.com","affectedData":[{"vendor":"smub","product":"Smash Balloon Social Photo Feed – Easy Social Feeds Plugin","defaultStatus":"unaffected","versions":[{"version":"0","lessThanOrEqual":"6.11.3","versionType":"semver","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security@wordfence.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":4.7,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":2.7}]},"weaknesses":[{"source":"security@wordfence.com","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"references":[{"url":"https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L319","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L361","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L386","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.0/admin/SBI_Callout.php#L448","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L319","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L361","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L386","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/instagram-feed/tags/6.11.3/admin/SBI_Callout.php#L448","source":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3619076/instagram-feed/trunk/admin/SBI_Callout.php?old=3481379&old_path=instagram-feed%2Ftrunk%2Fadmin%2FSBI_Callout.php","source":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/33f1d8b9-3561-4347-8267-8c36d4c9071f?source=cve","source":"security@wordfence.com"}]}},{"cve":{"id":"CVE-2026-66747","sourceIdentifier":"disclosure@vulncheck.com","published":"2026-08-05T11:16:25.510","lastModified":"2026-08-05T11:16:25.510","vulnStatus":"Received","cveTags":[],"descriptions":[{"lang":"en","value":"Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads. It opens no listening port; it phones home over cleartext TCP to a hardcoded command-and-control server (command channel 7000, interactive-shell callback 7001) with no authentication and no transport encryption, re-attempting contact roughly every 35 seconds. Its command handler passes any received string to popen() as uid=0, and a reserved rctlbash command returns an interactive root shell. Because the channel is unauthenticated and cleartext, control is not limited to whoever planted it: any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded fallback domain obtains unauthenticated remote code execution as root."}],"affected":[{"source":"disclosure@vulncheck.com","affectedData":[{"vendor":"Zbtlink","product":"CPE2801 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:cpe2801_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"22.10.09","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE1026-5G-WD Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we1026-5g-wd_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"21.04.07","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE1326 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we1326_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"22.02.18_1","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE2007 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we2007_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"23.08.12","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE2008-DSIM Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we2008-dsim_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"23.08.11","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE2416 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we2416_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"21.03.22_1","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE3326 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we3326_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"20.09.30","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE5927 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we5927_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"22.08.10","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE5931 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we5931_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"22.05.31","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE5931AC Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we5931ac_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"22.05.31","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WE826-T3-DSIM Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:we826-t3-dsim_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"21.12.21","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WG108 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:wg108_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"21.08.06_1","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WG209 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:wg209_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"21.07.28","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WG259 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:wg259_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"21.03.23","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WG1602 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:wg1602_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"23.10.11","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WG1608-DSIM Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:wg1608-dsim_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"23.03.16","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WG2105 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:wg2105_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"22.05.30","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WG2107 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:wg2107_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"22.09.08","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"WG3526 Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:wg3526_firmware:*:*:*:*:*:*:*:*"],"platforms":["MIPS","ARM"],"versions":[{"version":"22.11.01","versionType":"custom","status":"affected"}]},{"vendor":"Zbtlink","product":"ZBT-Z8102AX-2SIM Firmware","defaultStatus":"unaffected","cpes":["cpe:2.3:o:zbtlink:z8102ax_firmware:*:*:*:*:*:*:*:*"],"platforms":["ARM"],"versions":[{"version":"7.6.7.2-25.0814_114432","versionType":"custom","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"disclosure@vulncheck.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"disclosure@vulncheck.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}]},"weaknesses":[{"source":"disclosure@vulncheck.com","type":"Primary","description":[{"lang":"en","value":"CWE-506"}]}],"references":[{"url":"https://github.com/ycsunjane/rctl","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/zbt-endlessdoors","source":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/blog/zbt-endlessdoors","source":"disclosure@vulncheck.com"},{"url":"https://www.zbtlink.com/pages/zbt-router-firmware-download","source":"disclosure@vulncheck.com"}]}}]}