CVE-2026-20036 Cisco UCS Manager Software Command Injection Vulnerability

A vulnerability in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with valid administrative privileges to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to...

CVE-2026-20126

A vulnerability in Cisco Catalyst SD-WAN Manager could allow an authenticated, local attacker with low privileges to gain root privileges on the underlying operating system. This vulnerability is due to an insufficient user authentication mechanism in the REST API. An attacker could exploit this...

Cisco FXOS and UCS Manager Software Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to perform command injection attacks on an affected system and elevate privileges to root. This vulnerability is...

Cisco UCS Manager Software Command Injection Vulnerability

A vulnerability in the CLI and web-based management interface of Cisco UCS Manager Software could allow an authenticated, remote attacker with valid administrative privileges to execute arbitrary commands on the underlying operating system of an affected device. This vulnerability is due to...

CVE-2025-67445

TOTOLINK X5000R V9.1.0cu.2415B20250515 contains a denial-of-service vulnerability in /cgi-bin/cstecgi.cgi. The CGI reads the CONTENTLENGTH environment variable and allocates memory using malloc CONTENTLENGTH + 1 without sufficient bounds checking. When lighttpd s request size limit is not enforce...

CVE-2026-27598 Dagu: Path traversal in DAG creation allows arbitrary YAML file write outside DAGs directory

Dagu is a workflow engine with a built-in Web user interface. In versions up to and including 1.16.7, the CreateNewDAG API endpoint POST /api/v1/dags does not validate the DAG name before passing it to the file store. An authenticated user with DAG write permissions can write arbitrary YAML files...

PT-2026-21950

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software affected versions not specified Cisco UCS Manager Software affected versions not specified Description A flaw exists in the web-based management interface of Cisco FXOS Software and Cisco UCS Manager Software that could...

PT-2026-21938

Name of the Vulnerable Software and Affected Versions Cisco UCS Manager Software affected versions not specified Description A flaw exists in the Command Line Interface CLI and web-based management interface of Cisco UCS Manager Software that could permit an authenticated, remote attacker...

The vulnerability of the “endpoint” web interface module in the IP-telephony system management software FreePBX allows a hacker to execute arbitrary code.

The vulnerability of the “endpoint” web interface module in the IP telephony system management software FreePBX is related to the lack of measures taken to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the /goform/set_ac_server file in the Web Management Interface component of the D-link DIR-823X router’s microprogramming system allows a hacker to execute any command they desire.

The vulnerability of the /goform/setacserver file in the Web Management Interface component of the D-link DIR-823X router microprogramming system is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

The vulnerability of the BMC IPMI web interface, related to access control errors, allows attackers to bypass authentication and execute arbitrary commands.

The vulnerability of the BMC IPMI web interface is related to access control errors. Exploiting this vulnerability allows a malicious actor to bypass authentication and execute arbitrary commands remotely...

PT-2026-21998

Name of the Vulnerable Software and Affected Versions Rucio versions prior to 35.8.3 Rucio versions prior to 38.5.4 Rucio versions prior to 39.3.1 Description Rucio’s WebUI login endpoint, /ui/login, returns different error messages based on whether a supplied username exists. This allows...

PT-2026-22000

Name of the Vulnerable Software and Affected Versions Rucio versions prior to 35.8.3 Rucio versions prior to 38.5.4 Rucio versions prior to 39.3.1 Description Rucio is a software framework used to organize, manage, and access large volumes of scientific data. A stored Cross-Site Scripting XSS iss...

CVE-2026-22553

All versions of InSAT MasterSCADA BUK-TS are susceptible to OS command injection through a field in its MMadmServ web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution...

CVE-2026-21410

InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution...

CVE-2026-22553

CVE-2026-22553 affects all versions of InSAT MasterSCADA BUK-TS. It exposes an OS command injection via a field in the MMadmServ web interface, potentially enabling remote code execution. The provided data lists high impact across confidentiality, integrity, and availability, with network access ...

CVE-2026-21410

InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution...

CVE-2026-21410 InSAT MasterSCADA BUK-TS SQL Injection

InSAT MasterSCADA BUK-TS is susceptible to SQL Injection through its main web interface. Malicious users that use the vulnerable endpoint are potentially able to cause remote code execution...

CVE-2026-21410

CVE-2026-21410 affects InSAT MasterSCADA BUK-TS. The vulnerability is a SQL Injection via the main web interface that potentially allows remote code execution. Impact is indicated as high for confidentiality, integrity, and availability. No remediation details are provided in the supplied documen...

CVE-2026-27520

Binardat 10G08-0800GSM network switch firmware versions prior to V300SP10260209 store a user password in a client-side cookie as a Base64-encoded value accessible via the web interface. Because Base64 is reversible and provides no confidentiality, an attacker who can access the cookie value can...