EUVD-2026-76738

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

EUVD-2026-76744

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

CVE-2026-90449

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

CVE-2026-90456

CVE-2026-90456 affects a bundled inventory-management component whose example environment-configuration file ships with a fixed, publicly-known administrative password . If a deployment copies this example file into active configuration without running the setup routine that regenerates credentia...

CVE-2026-90456 Use of default credentials in Malcolm

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that...

CVE-2026-90449 Missing Authentication for Critical Function in Malcolm

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

CVE-2026-90449

CVE-2026-90449 affects a reverse proxy/gateway in an ICS/OT deployment (per the referenced CISA advisory icsa-26-254-01 ). When a particular authentication mode is configured, the reverse proxy forwards requests to a bundled third-party administrative interface without first applying the gateway'...

CVE-2026-90449 Missing Authentication for Critical Function in Malcolm

When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that interface without applying the gateway's own authentication requirement first. All access control for this administrative interface, which...

PT-2026-90525

Name of the Vulnerable Software and Affected Versions Inventory Management Component affected versions not specified Description An example environment-configuration file for a bundled inventory-management component contains a fixed, publicly-known administrative password. If this example file is...

PT-2026-90518

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description When a specific authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface directly to that...

CVE-2026-86165

A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Performing a manipulation of the argument Keywd/urlFQDN results in buffer overflow. The attack may be initiated remotely. The exploit has been made public and cou...

PT-2026-84734

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' CWE-22 in the Kibana Fleet feature can lead to the unauthorized deletion of resources via Path Traversal CAPEC-126. A low-privileged user could cause a subsequent action taken by a higher-privileged user in the Fleet...

EUVD-2026-68015

Silverstripe Versioned provides versioning for Silverstripe models. Prior to 3.2.1, RestoreAction::getRestoreMessage in src/RestoreAction.php builds ArchiveAdmin restore notifications rendered as CASTHTML and inserts $restoredItem-Title, $restoredItem-URLSegment, $restoredItem-CMSEditLink, and...

CVE-2026-55485 Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccoloadmin/endpoints.py uses superuservalidators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET requests to configured user and session table...

CVE-2026-78555 RansomLook API Key Disclosure Through /admin/apikeys HTML Source

RansomLook exposed complete API keys in the HTML source of the authenticated /admin/apikeys administration page. Although the interface displayed only a shortened representation of each key, the full token was embedded in hidden form fields used by the enable/disable, private-access, and delete...

wagtail-sb-admin-interface (>=0.6.0, <=0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by unknown CVE via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.6.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-JM5P-837G-RV8G...

wagtail-sb-admin-interface (>=0.0.0, <=0.5.0), wagtail-sb-codefield (>=0.1.0, <=0.3.0) +2 more potentially affected by unknown CVE via wagtail (5.0.0rc1)

wagtail PYPI version 5.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.0.0, =0.1.0, =0.1.0, =0.4.0, =0.6.0 Source cves: unknown CVE Source advisory: OSV:GHSA-X5CX-W6P2-MXF2...

wagtail-sb-admin-interface (>=0.6.0, <=0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by unknown CVE via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.6.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-X5CX-W6P2-MXF2...

wagtail-sb-admin-interface (>=0.6.0, <=0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by unknown CVE via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.6.0, =0.1.0, =0.1.0, =0.2.0 Source cves: unknown CVE Source advisory: OSV:GHSA-92HV-J533-69WC...

wagtail-sb-admin-interface (>=0.6.0, <=0.7.0), wagtail-sb-codefield (0.4.0) +4 more potentially affected by CVE-2026-55468 via wagtail (6.0.0rc1)

wagtail PYPI version 6.0.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-sb-admin-interface =0.6.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2026-55468 Source advisory: OSV:GHSA-3VRH-M9W7-V94F...