CVE-2026-16315 Authentication and authorization bypass via cryptographic timing side-channel attack in StationGuard

OMICRON StationGuard before version 4.10 contains a cryptographic timing side-channel vulnerability in the backend authentication mechanism that may allow an unauthenticated attacker to forge valid authentication credentials, bypass authentication and authorization, and impersonate legitimate...

External Control of System or Configuration Setting

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to External Control of System or Configuration Setting via the window.open. An attacker can cause the main process to access...

CVE-2026-7849

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root...

CVE-2026-44099

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-7849

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root...

EUVD-2026-51044

Due to improper neutralization of special elements, an unauthenticated remote attacker is able to inject a command into the system configuration which is subsequently executed as root...

EUVD-2026-51034

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44099

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

CVE-2026-44092 Missing input validation / stripping of CRLF characters in SystemConfigManager

An unauthenticated remote attacker can inject malicious input into the ModbusServer application because it does not validate the input it fetches from MQTT. This may lead to integrity and availability loss...

CVE-2026-44091 Creation of a new configuration by posting a malicious ID to MQTT

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss...

EUVD-2026-51026

An unauthenticated remote attacker can post a malicious ID to the MQTT Broker results in the creation of a new configuration entry in the system configuration. This may lead to integrity and availability loss...

PT-2026-66437

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description An unauthenticated remote attacker can perform a configuration injection that allows the execution of arbitrary commands as root. This occurs due to the improper...

PT-2026-66427

A privilege escalation vulnerability in the system configuration allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise...

PT-2026-66419

Name of the Vulnerable Software and Affected Versions Phoenix Contact CHARX SEC-3150 affected versions not specified Description The MQTT Service contains a Server-Side Request Forgery SSRF flaw. An unauthenticated remote attacker can send a malicious ID to the MQTT Broker, which allows the...

Dify v1.9.1 - Broken Access Control Detection

Dify v1.9.1 contains an insecure permissions vulnerability caused by lack of authorization checks in /console/api/system-features endpoint, letting unauthenticated attackers access sensitive system configuration data. !/usr/bin/env python3 -- coding: utf-8 -- """Dify v1.""" from kittysploit impor...

Django Debug Configuration Enabled Detection

Django debug configuration is enabled, which allows an attacker to obtain system configuration information such as paths or settings. !/usr/bin/env python3 -- coding: utf-8 -- """Django debug configuration is enabled, which allows an attacker to obtain system configuration information suc.""" fro...

Netgear R6850 - Information Disclosure Detection

Netgear R6850 router firmware version V1.1.0.88 contains an information leakage vulnerability in the currentsetting.htm page.This hidden interface is not protected by authentication, allowing unauthenticated attackers to access sensitive informationsuch as firmware version, model details,...

ROS-20260716-73-0044

The vulnerability in Vim is related to incorrect elimination of separators. Exploiting this vulnerability can allow an attacker to gain access to modify the system’s configuration...

CVE-2026-8079 Unintended limited set of actions with elevated privileges may be performed during PDF generation in Progress Flowmon

In Progress Flowmon versions prior to 12.5.9 and 13.0.11, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the PDF generation process that results in operations being performed with the privileges of another user, potentially leading to unauthorized...

CVE-2026-57283

A flaw was found in Jenkins Pipeline: Groovy Plugin. This cross-site request forgery CSRF vulnerability allows attackers to instantiate types related to job or system configuration. This could enable unauthorized modifications to the Jenkins environment...