CVE-2026-75364

Comfast CF-N1-S (firmware 2.6.0.1) and CF-WR630AX (2024-01-30 build) contain a command injection vulnerability in the update_interface_png SET handler within /usr/bin/webmgnt . The display_name parameter is not sanitized; user-controlled input is concatenated via sprintf() into the unquoted shell...

Linux Distros Unpatched Vulnerability : CVE-2026-48549

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Nagios Core before 4.5.13 and Nagios XI before 2026R1.5 contains a CSRF vulnerability in cmd.cgi. When no Cookie header is present, the double-submit cookie...

PT-2026-82318

Name of the Vulnerable Software and Affected Versions LimeSurvey Community Edition version 7.0.5 Description An authenticated stored cross-site scripting issue exists in the replacement-fields dialog within the administrative question editor. Stored cross-site scripting occurs when an application...

EUVD-2020-31268

An issue was discovered in LibreNMS 1.65. A remote authenticated attacker with normal privileges can extract all the information from the LibreNMS database via a SQL injection in the sort parameter in the /ajaxtable.php API endpoint. This affects address-search.inc.php, alertlog.inc.php,...

CVE-2020-15874

CVE-2020-15874 is a command injection vulnerability in LibreNMS version 1.65 , located in the /graph.php API endpoint. A remote authenticated attacker with normal privileges can leverage the flaw to execute arbitrary shell commands on the underlying system. The fix is available in LibreNMS 1.65.1...

CVE-2020-15878

CVE-2020-15878 is a SQL injection vulnerability in LibreNMS 1.65 , specifically in the address parameter of the /ajax_table.php API endpoint. A remote authenticated attacker with normal privileges can exploit this flaw to extract all information from the LibreNMS database. The fix is available in...

Linux Distros Unpatched Vulnerability : CVE-2026-34968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 5.4.3 contains an arbitrary file deletion vulnerability in SQLite mode where the database- list drop action fails to validate file extensions...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098991)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098991 advisory. In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel: punitipc: fix memory corruption This passes the address of the pointer...

GitLab 12.8 < 19.1.7 / 19.2 < 19.2.5 / 19.3 < 19.3.1 (CVE-2026-77801)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 that, under certain conditions, could have allowed an...

CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2026-80197 Kimai before 2.57.0 Improper Authorization via Favorite Endpoints

Kimai before 2.57.0 contains an improper authorization vulnerability in the favorite timesheet add and remove endpoints that allows authenticated users to manipulate other users' bookmarks. Attackers can add or remove timesheet entries from another user's favorite list by referencing their...

CVE-2023-0861-POC

Analysieren und Reproduzieren der Befehlsinjektions-Schwachstelle CVE-2023-0861 in NetModule Routern NetModule ist ein Original Equipment Manufacturer OEM von industriellen Routern, die häufig in kritischer Infrastruktur und industriellen Steuerungssystemen eingesetzt werden. Am 24. Februar 2023...

CVE-2025-63307

CVE-2025-63307 – Cross-site Scripting XSS persistente autenticato in laravel-file-manager v3.3.1 🧭 Panoramica Una vulnerabilità di Cross-site Scripting XSS persistente autenticato in laravel-file-manager v3.3.1 e versioni precedenti consente ad attaccanti con accesso all'interfaccia del file...

CVE-2026-38474

GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP lock manager, which allows remote authenticated users to add, modify, or delete IP lock entries for arbitrary accounts via tools.php?action=iplock...

CVE-2026-38469

A Stored XSS vulnerability in the custom bonus title feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the title parameter in /bonus.php and /user.php?action=stafftool...

CVE-2026-38473

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

CVE-2026-38467

A SQL injection vulnerability in the tags manager in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersmod privileges to execute arbitrary SQL commands via the tagid or type parameter in a crafted POST request to...

CVE-2026-38468

A SQL injection vulnerability in the country-code lookup endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users with usersviewips privileges to execute arbitrary SQL commands via the ip parameter in a crafted request to...

CVE-2026-38465

A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via the avatarmouseovertext parameter, which is stored and later rendered in avata...

CVE-2026-38470

A Broken access control vulnerability in the API user endpoint in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows unprivileged, authenticated users to enable or disable arbitrary user accounts via the req=disable or req=enable action using a normal user-created...