CVE-2026-56434

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpssimodule module. This vulnerability may exist when the Server-Side Includes SSI, proxypass, and proxybuffering off directives are configured. With this configuration, an unauthenticated attacker with man-in-the-middle MITM abili...

CVE-2026-58554

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-58554

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-58554

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

EUVD-2026-44659

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-58554

CVE-2026-58554 is a permission control vulnerability in the Settings module. The root cause is permission control weaknesses that can lead to confidentiality impact. CVSS-3.1 measures: Local attack vector, Low attack complexity, No privileges required, User interaction required, Confidentiality i...

CVE-2026-58554

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2026-60167

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-58554: Exposure of Sensitive Information to an Unauthorized Actor

Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2026-56679: Improperly Controlled Modification of Dynamically-Determined Object Attributes

9Router is an AI router & token saver. Prior to 0.5.4, the PATCH /api/settings endpoint writes the entire request body to persistent settings without a field whitelist, allowing an authenticated user to set security-critical fields such as requireLogin and disable authentication for the whole...

PT-2026-60305

Name of the Vulnerable Software and Affected Versions 9Router versions prior to 0.5.4 Description An authenticated user can modify security-critical settings because the PATCH '/api/settings' endpoint writes the entire request body to persistent settings without using a field whitelist. By...

CVE-2026-50651

.NET Denial of Service Vulnerability - HTTP/2 SETTINGS/PING ACK flood causing OOM...

CVE-2026-62659 Authenticated users can make unauthorized changes on NETGEAR WAX333 Access Points

A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings...

CVE-2026-62659 Authenticated users can make unauthorized changes on NETGEAR WAX333 Access Points

A security flaw was discovered in the NETGEAR WAX333 Access Point that could allow someone already logged in and connected to the local network to make unauthorized changes to the device's settings...

EUVD-2026-44328

A security flaw was found in certain NETGEAR RAX models that could allow a logged-in user to send specially crafted requests to the router and run unauthorized commands. This could enable the user to make unauthorized changes to the router and affect its security and operation...

CVE-2026-58477

Sustainable Irrigation Platform SIP through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to...

CVE-2026-58477 Sustainable Irrigation Platform 5.2.16 Mass Assignment via HTTP Parameters

Sustainable Irrigation Platform SIP through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to...

EUVD-2026-43688

Sustainable Irrigation Platform SIP through version 5.2.16 contains a mass assignment vulnerability that allows unauthenticated attackers to overwrite sensitive configuration settings by supplying arbitrary parameter names in HTTP requests. Attackers can manipulate parameters corresponding to...

CVE-2026-58477

SIP (Sustainable Irrigation Platform) up to version 5.2.16 contains a mass assignment flaw where the value-setting interface copies every HTTP parameter into internal settings without whitelisting. This enables unauthenticated attackers to overwrite sensitive configuration such as the passphrase ...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the rate editing process for projects, customers, and activities. An attacker can modify billing-related rate configurations outside their authorized scope by combining an authorized...