CVE-2026-73670

A CMS contains a SQL injection vulnerability in admin/dbdata.php at line 509 that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement by supplying unsanitized input through the tablename GET or POST parameter. Attackers can perform table traversal,...

CVE-2026-73670

The CVE describes a SQL injection in a CMS affecting the admin/db_data.php component (line 509) that allows authenticated administrators to inject arbitrary SQL into a SHOW COLUMNS FROM statement via an unsanitized table_name parameter (GET/POST). Attack techniques include table traversal, time-b...

PT-2026-71704

CyberPanel before 3.0.0 contains a path traversal vulnerability that allows authenticated administrators to read arbitrary files from the server filesystem by supplying unsanitized file paths to the cloudAPI ReadReport endpoint. Attackers can manipulate the reportFile parameter in the JSON reques...

PT-2026-71691

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A CMS contains a SQL injection flaw in the 'admin/db data.php' endpoint. Authenticated administrators can inject arbitrary SQL into a SHOW COLUMNS FROM statement...

CVE-2026-73432

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-73432 Stored Server-Side Request Forgery in Remote-Instance Synchronization Allows Access to Internal Services in vulnerability-lookup

Vulnerability-Lookup contains a server-side request forgery SSRF vulnerability in the remote-instance synchronization functionality. Remote instance addresses were validated only for basic URL syntax before being stored, while the synchronization worker later dereferenced these addresses using...

CVE-2026-11735

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-11738 Insufficient input validation in certain NETGEAR Nighthawk routers allows administrators to tamper with the device.

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality...

CVE-2026-11738

CVE-2026-11738 describes an insufficient input validation vulnerability affecting certain NETGEAR Nighthawk routers (e.g., RAXE500, RS700, R7000). It allows authenticated administrators on the local network to tamper with router software and functionality, enabling unauthorized modification. The ...

CVE-2026-11734 Device administrator can interrupt the normal operation of some NETGEAR Nighthawk devices.

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable...

EUVD-2026-56189

Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to the device software and functionality...

CVE-2026-11737

The CVE affects several NETGEAR Nighthawk models (listed in the references: RAX42, RAX45, RAX50, RAX43, RAX20, RAX41v2, RAX49s, RAX41, RAX42v2, RAX43v2, RAX50v2). The vulnerability is described as insufficient input validation in the device’s management-facing interface, allowing authenticated ad...

CVE-2026-72604

A path traversal vulnerability in Intelliants Subrion CMS through 4.2.1 allows authenticated administrators to delete arbitrary files on the server via the admin panel file deletion endpoint. The endpoint passes a user-supplied file path directly to unlink without sanitization or path...

CVE-2026-72604

CVE-2026-72604 affects Intelliants Subrion CMS up to version 4.2.1. A path traversal flaw in the admin panel file deletion endpoint allows an authenticated administrator to pass a user-supplied path to unlink() without sanitization or path canonicalization, enabling deletion of arbitrary files ou...

CVE-2026-24329 Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user.

A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml...

CVE-2026-11735: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality...

CVE-2026-11734: Stack-based Buffer Overflow

A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable...

CVE-2026-11736: Improper Input Validation

A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality...

PT-2026-70230

Name of the Vulnerable Software and Affected Versions NETGEAR affected versions not specified Description Insufficient input validation allows authenticated administrators connected to the local network to make unauthorized modifications to the device software and functionality. Recommendations A...