CVE-2026-76557: Improper Neutralization of Special Elements used in an SQL Command

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

PT-2026-93282

The WP Import Export Lite WordPress plugin before 3.9.33 does not properly sanitise and escape some import configuration values before using them in SQL statements, allowing users whose role an administrator has granted the WP Import Export Lite WordPress plugin before 3.9.33's import permission ...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38571)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the setWiFiMeshConfig function. Attackers can exploit this vulnerability by sending a specially crafted...

PT-2026-93971

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE and Cisco ISE Passive Identity Connector ISE-PIC could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-si...

CVE-2026-92751: Cross-Site Request Forgery (CSRF)

CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of authenticated operators. Attackers can craft hidden forms that submit to destructive endpoints like topic deletion and cluster configuration changes,...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38577)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the setWizardCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38429)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from incorrect access control in the setLanCfg function. Attackers can exploit this vulnerability by sending specially crafted POST request...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38422)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. There is an access control vulnerability in the TOTOLINK T6. This vulnerability stems from improper access control in the LoadDefSettings function. Attackers can exploit this vulnerability by sending a specially crafted POST...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38592)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from an improper access control in the recvmeshinfosync function. Attackers can exploit this vulnerability to force mesh configuration...

PT-2026-94045

Name of the Vulnerable Software and Affected Versions Rundeck versions prior to 6.2.2 Description The project archive import endpoint fails to properly authorize the importConfig and importNodesSources parameters. This allows attackers who possess only the import action permission to replace...

PT-2026-93424

Name of the Vulnerable Software and Affected Versions Arista EOS affected versions not specified Description On platforms running Arista EOS with Simple Network Management Protocol SNMP configured, SNMPv3 local or remote user credentials may be exposed as a one-way hashed, localized key value...

PT-2026-93335

XikeStor Layer3 switches miss authentication for downloading configuration data. Unauthenticated attacker may retrieve the configuration data containing network configurations and passwords to operate the affected product improperly or to exploit the affected product as a jump host...

CVE-2026-86108: Improper Neutralization of Special Elements used in an OS Command

Insufficient validation of inputs supplied through affected VeloCloud Edge management and configuration workflows may allow an authorized management request or configuration value to be interpreted as an operating-system command. Successful exploitation may allow command execution with elevated...

TOTOLINK T6 Access Control Vulnerability (CNVD-2026-38416)

TOTOLINK T6 is a wireless dual-band Mesh router launched by TOTOLINK. The TOTOLINK T6 has a vulnerability related to access control. This vulnerability stems from improper access control in the getPairCfg function. Attackers can exploit this vulnerability by sending a specially crafted POST reque...

AlmaLinux 9 : rsyslog (ALSA-2026:67583)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:67583 advisory. rsyslog: A configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd CVE-2026-19654 Tenab...

The vulnerability of the authentication mechanism of the N-able N-central platform for monitoring and managing IT infrastructure allows a hacker to circumvent security restrictions.

The vulnerability of the authentication mechanism of the N-able N-central platform for monitoring and managing IT infrastructure is related to incorrect input of configuration data. Exploiting this vulnerability can allow a malicious actor to bypass security restrictions remotely...

CVE-2026-76867

Netcore NR255-V firmware version 1.5.130703 contains a stored cross-site scripting vulnerability in routing and NAT configuration CGI components including routingtabaddcgi, routingtablelistshowcgi, routepolicyaddcgi, and routepolicyparameshowcgi. Attackers can inject persistent script payloads...

CVE-2026-76856

Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wanconfigsetcgi, wannumsetcgi, and lanipchangecgi endpoints. Attackers can craft forged requests to trick authenticated administrators into modifying WAN or LAN network configuration...

CVE-2026-76858

Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddnswanlistshow.cgi caused by unsafe eval handling of DDNS data. Attackers can inject malicious script through the DDNS configuration path, leading to persistent execution when the affected page is viewed...

CVE-2026-76867

Netcore NR255-V (firmware 1.5.130703 ) is affected by a stored cross-site scripting (XSS) vulnerability in four routing and NAT configuration CGI handlers: routing_tab_add_cgi , routing_table_list_show_cgi , route_policy_add_cgi , and route_policy_parame_show_cgi . Attackers with low privileges c...