cve.bz

tongcheng-security-team nextscan vulnerabilities, newest first

Filter

By year: all 2026 2025 2024 2023 2022 2021

  1. 8.8CVE-2026-126802EPSS 0.3%

    NextScan 1.1.0 through 1.2.0 contains hardcoded HTTP Basic Auth credentials in ns-admin's AuthAgent and AuthExternal routers that allow unauthenticated attackers to access protected APIs. Attackers can call /agent/config to obtain Redis pa…

  2. 2.1CVE-2026-126798EPSS 0.2%

    NextScan 1.1.0 through 1.2.0 contains a stored cross-site scripting vulnerability in the ns-admin URL asset detail dialog that renders crawled form request bodies (Asset_URL.data) via innerHTML without encoding. Attackers can host crafted …

  3. 9.3CVE-2026-126797EPSS 0.6%

    NextScan 1.1.0 through 1.2.0 contains an authentication bypass vulnerability in ns-admin that allows unauthenticated attackers to forge administrator tokens using a hardcoded JWT signing key. Attackers can sign an HS256 X-Access-Token carr…