CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: TP-Link Router OS Command Injection For more Information see https://vulners.com/cve/CVE-2026-3227 A persistent, authenticated OS Command Injection vulnerability in TP-Link router firmware leading to device bricking or potential LAN takeover. Disclaimer : This repository contains...

CVE-2026-20127

🛡️ CVE-2026-20127 — Cisco Catalyst SD-WAN Authentication Bypass 📌 Overview CVE-2026-20127 is a critical authentication bypass vulnerability affecting Cisco Catalyst SD-WAN components, including controllers and management systems. A remote unauthenticated attacker can exploit improper authenticatio...

TOTOLINK A3002RU 1.0.8 - Information Disclosure

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for password.htm. This allows remote attackers to gain administrative access without credentials. id: CVE-2018-13317 info: name:...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

CData Connect < 23.4.8846 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Connect 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31849 info: name: CData Connect 23.4.8846...

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

EUVD-2026-98079

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication...

CVE-2026-19620

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication...

CVE-2026-19620

IBM Planning Analytics versions 2.0 and 2.1 are vulnerable to a security flaw that allows a remote attacker to gain unauthorized administrative access . This issue is caused by improper authentication (CWE-288). The vulnerability has a CVSS 3.1 base score of 8.8 (HIGH) , indicating high impact on...

CVE-2026-19620 IBM Planning Analytics Local is affected by security vulnerabilities

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to gain unauthorized administrative access due to improper authentication...

CVE-2026-109575

In HAProxy Data Plane API 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases, Server.ConfigureAPI has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority tlsca is configured and a numeric TLS...

CVE-2026-85950

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized...

EUVD-2026-97509

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized...

CVE-2026-85950

Progress MarkLogic Server versions 12.x before 12.1.0 and 11.x before 11.3.7 are affected by an authorization flaw within the REST extensions . This improper privilege management allows a remote attacker with administrative privileges to access authentication material belonging to higher-privileg...

CVE-2021-40859

CVE-2021-40859 Auerswald COMpact 8.0B Backdoors exploit About Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device. Product Details Product: COMpact 3000 ISDN,...

CVE-2026-33272

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally...

CVE-2026-32645

Default factory credentials with administrative access are enabled and persist even after configuring other administrator accounts...

CVE-2026-32645

The Red Lion Controls N-Tron 700 Series is affected by a vulnerability involving the use of hard-coded credentials . Specifically, default factory credentials with administrative access remain active and persist even after additional administrator accounts have been configured. This flaw allows f...