CVE-2026-75937

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

CVE-2026-75937 OS Command Injection in Digi Accelerated Linux (DAL OS)

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

EUVD-2026-91802

A specially crafted HTTP POST request to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. Disable the web server when not configuring the device...

CVE-2026-75937

A critical OS Command Injection vulnerability (CVE-2026-75937) affects Digi Accelerated Linux (DAL OS) . A specially crafted HTTP POST request sent to the web administration interface allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the aff...

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting

Apache ActiveMQ versions 5.0.0 to 5.15.5 are vulnerable to cross-site scripting via the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter. id: CVE-2018-8006 info: name: Apache ActiveMQ =5.15.5 - Cross-Site...

CVE-2026-101081

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menunatmoreasp of the file menunatmore.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched...

EUVD-2026-88345

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menunatmoreasp of the file menunatmore.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched...

CVE-2026-101081 D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menunatmoreasp of the file menunatmore.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched...

CVE-2026-101081 D-Link DI-8400 Web Administration Service menu_nat_more.asp menu_nat_more_asp stack-based overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menunatmoreasp of the file menunatmore.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched...

CVE-2026-101081

The D-Link DI-8400 running firmware version 16.07 is vulnerable to a stack-based buffer overflow in the Web Administration Service . The flaw exists within the menu_nat_more_asp function of the menu_nat_more.asp file, where manipulating the opt argument can trigger the overflow. This vulnerabilit...

CVE-2026-101081: Stack-based Buffer Overflow

A security flaw has been discovered in D-Link DI-8400 16.07. This vulnerability affects the function menunatmoreasp of the file menunatmore.asp of the component Web Administration Service. The manipulation of the argument opt results in stack-based buffer overflow. The attack can be launched...

[SECURITY] Fedora 45 Update: cockpit-367-1.fc45

The Cockpit Web Console enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more...

EUVD-2026-71218

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

CVE-2026-14466

Stormshield SNS is vulnerable to a stored XSS in its web administration panel. An SNS administrator with appropriate permissions can inject a malicious script into a group's comments within the webservices administration interface , leading to execution in the context of other users. The CVSS v3....

CVE-2026-14466 Possible XSS in the SNS web administration panel

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

CVE-2026-14466: Improper Neutralization of Input During Web Page Generation

It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with appropriate permissions must inject some malicious script in a group’s comments in the webservices administration interface...

CVE-2026-15933

OptimiDoc Server (On-Premise) stores credentials for external services in cleartext, allowing an authenticated administrator to view previously configured passwords—SMTP , FTP (scan delivery), Active Directory (user list import), and SharePoint —in cleartext through the web administration panel p...

CVE-2026-15933: Plaintext Storage of a Password

OptimiDoc Server On-Premise stores credentials for external services in cleartext. An authenticated administrator can view previously configured service passwords, including SMTP, FTP for scan delivery, Active Directory for user list import, and SharePoint credentials, in cleartext via the web...

CVE-2026-78414

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...

PT-2026-80899

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...