CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.5.0 , the application fails to apply the RequireSecureSession middleware to several sensitive mutation routes, including the api/cluster router. This allows an authenticated user with a stolen or persisted JWT to bypass...

CVE-2026-84315

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2025-27895

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to a cross-site scripting (XSS) vulnerability. This flaw allows an unauthenticated attacker to embed arbitrary JavaScript code into the Web UI , which can alter intended functionality and potentially lead to credentials di...

EUVD-2025-211065

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27895 DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting

IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27896

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to a cross-site scripting (XSS) flaw. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code into the Web UI. Successful exploitation can alter the application's intended functionality and...

EUVD-2025-211064

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27896 IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

EUVD-2025-211063

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27897 IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within ...

CVE-2025-27897

IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to a cross-site scripting (XSS) flaw (CWE-79). This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code into the Web UI , which can alter the application's functionality and potentially lead...

CVE-2026-109373

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them wi...

CVE-2026-109371

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109346

better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET /device omits the requesting clientid and scope. Attackers can start a device request via /device/code, trick signed-in users into approving the code, then...

CVE-2026-108908

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7callboarduserset.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched...

CVE-2026-108908

A vulnerability exists in the Netcore NR268 version 1.7.121109 within the Web UI component. Specifically, the eval function in the file /router/l7_call_board_user_set.cgi fails to properly sanitize inputs, allowing for cross-site scripting (XSS) . An attacker can trigger this by manipulating the ...

CVE-2026-108908 Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7callboarduserset.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched...

EUVD-2026-97558

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7callboarduserset.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched...

CVE-2026-108901

A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the component Display QR Code Rendering. Performing a manipulation of the argument alignment results in improper restriction of rendered ui layers. The attack ca...