CVE-2026-95675

D-Link DAP-1360 firmware 6.14 and earlier is affected by an unauthenticated remote code execution vulnerability in the device's web management interface . Remote attackers can send crafted requests without valid credentials to execute arbitrary commands as root , enabling full device compromise, ...

EUVD-2026-84394

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

CVE-2026-95675 D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

CVE-2026-95675 D-Link DAP-1360 6.14 Unauthenticated RCE via Web Management Interface

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

shannon v3.3.0

!NOTE Cyber verification for Anthropic and OpenAI models: complete your provider's cyber verification program to prevent model failures and refusals during cyber workloads. Shannon is an autonomous, AI pentester for web applications and APIs. It analyzes your source code, identifies attack paths,...

WordPress Web to Print Online Designer plugin < 2.15.0 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Mike Gozdiskowski in WordPress Plugin Web to Print Online Designer versions 2.15.0...

Web-App-PenTesting

--- 🚀 Quick Start 1. Clone the repository bash git c...

Day-22--Reflected-Cross-Site-Scripting-XSS-in-HTML-Context

Day 22: Reflected Cross-Site Scripting XSS in HTML Context...

CVE-2026-80154: Use of Insufficiently Random Values

All firmware versions of Lantronix SLC8000, SLC9000, EMG8500, EMG7500, SLB882, SLCx-03, and SLCx-02 contain an authentication bypass vulnerability in the web management portal that allows unauthenticated attackers to derive valid session tokens of logged-in users and bypass source IP and User-Age...

CVE-2026-83602: Improper Access Control

Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/webapiv3.c with HTTPACLNOCHECK and HTTPACCESSANONYMOUSDATA, causing unauthenticated PUT requests handled by src/web/api/v3/apiv3settings.c to bypass operator-configured allo...

UBUNTU-CVE-2026-61630

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

PT-2026-96811

Name of the Vulnerable Software and Affected Versions SLC8000 versions prior to 9.7.0.5 SLC9000 versions prior to 9.7.0.2 EMG8500/EMG7500 versions prior to 9.7.0.1 SLB882 affected versions not specified SLCx-03 affected versions not specified SLCx-02 affected versions not specified Description A...

VulnCheck KEV: CVE-2026-66457

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2...

CVE-2026-95675: Improper Neutralization of Special Elements used in an OS Command

D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary commands as root by sending crafted requests to the device's web management interface without valid credentials. Attackers can fully...

EUVD-2026-84851

An unrestricted upload of files with a dangerous type in the thumbnail-upload endpoint /index.php?m=member&f=article&v=thumbUpload of WuzhiCMS 5.0.0 allows an authenticated low-privileged member to upload a crafted .php file and execute arbitrary PHP code on the server, because the stored file...

PT-2026-96815

Name of the Vulnerable Software and Affected Versions Dark Reader versions prior to 4.9.126 Firefox Dark Reader versions prior to 4.9.128 Other browsers Description A website can trigger the image inversion pipeline of the browser extension to request an unauthenticated icon-like bitmap from a...

CVE-2026-92706: Exposure of Sensitive Information to an Unauthorized Actor

Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extension's image inversion pipeline to request an unauthenticated icon-like bitmap from a locally running web server when the resource uses a known public-like...

CVE-2026-88020: Improper Neutralization of Input During Web Page Generation

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

PT-2026-97042

Name of the Vulnerable Software and Affected Versions Autonomy Logic OpenPLC version 3 Description An improper neutralization of input during web page generation occurs in the web interface when routing programs based on a query string parameter that is not encoded. This cross-site scripting XSS...

CVE-2026-80156: Improper Limitation of a Pathname to a Restricted Directory

Lantronix SLC8000 before firmware v9.7.0.5, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware versions of SLB882/SLCx-03/SLCx-02 contain a path traversal vulnerability in the web management portal upload endpoint that allows authenticated attackers to...