CVE-2026-19412 Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability b...

CVE-2026-19412

CVE-2026-19412 affects the CP Plus CP-XR-DE21-S Router due to hardcoded HTTP Digest authentication credentials embedded in the firmware, which are identical across all devices running the affected firmware. An attacker with adjacent network access (no privileges required) can obtain these credent...

CVE-2026-19412 Hardcoded Credentials Vulnerability in CP Plus CP-XR-DE21-S Router

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability b...

PT-2026-83121

Name of the Vulnerable Software and Affected Versions CP Plus CP-XR-DE21-S affected versions not specified Description The CP Plus CP-XR-DE21-S Router contains hardcoded HTTP Digest authentication credentials within its firmware. These credentials are identical across all devices running the...

CVE-2026-19412: Use of Hard-coded Credentials

This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical across all devices running the affected firmware. An attacker with access to the local network could exploit this vulnerability b...

CVE-2026-78281

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78281 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78281 WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

EUVD-2026-66940

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78281

The WordPress plugin CP Media Player (versions

PT-2026-82459

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

CVE-2026-78281: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in CP Media Player = 1.3.0 versions...

PT-2026-82171

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the s390/vfio ccw component when the cp init function fails. While the cp free routine is used to unpin or free memory after successful I/O or when cp prefetch...

WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin CP Media Player versions = 1.3.0...

CVE-2026-47187

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-47187 SSHFS Symlink Escape: Rogue SFTP Server → Local File Read/Write

SSHFS is a network filesystem client for connecting to SSH servers. Prior to version 3.7.6, a rogue SFTP server can return absolute symlink targets or relative targets containing parent-directory components that SSHFS passes through FUSE for resolution by the client kernel against the local...

CVE-2026-49255 electerm: Command Injection in File System Operations (rmrf, mv, cp)

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf, mv, and cp functions. A malicious SSH or SFTP server can provide a...

CVE-2026-49255 electerm: Command Injection in File System Operations (rmrf, mv, cp)

electerm is an open-sourced terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client. Prior to 3.11.11, electerm constructs operating system commands in src/app/lib/fs.js by interpolating untrusted file paths into the rmrf, mv, and cp functions. A malicious SSH or SFTP server can provide a...

CVE-2026-45129

MyBB is free and open source forum software. Prior to 1.8.40, the Admin CP Recovery Codes module does not validate requests correctly, allowing same-site attackers to rotate a victim administrator's recovery codes with a specially crafted URL. The Admin CP Home, Preferences, Recovery Codes...

CVE-2026-45115

MyBB is free and open source forum software. Prior to 1.8.40, the Buddy/Ignore component does not sanitize usernames correctly, allowing attackers to perform JavaScript code injection through a specially crafted username. The User CP Buddy/Ignore list and the Select Buddies list in Private Messag...