18869 matches found
CVE-2026-33922
A flaw was found in Arc. This path traversal vulnerability exists within the Offline archives functionality of the local web interface. A local user with administrative credentials can exploit this by submitting an archive name containing special characters, allowing them to delete arbitrary file...
CVE-2026-33922
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...
EUVD-2026-55996
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...
CVE-2026-33922 Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...
CVE-2026-33922 Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...
CVE-2026-33922
CVE-2026-33922: Path traversal in the Offline archives feature of the Arc local web interface (Arc before v2.7.0). A local user with administrative Web UI credentials can submit an archive name containing traversal sequences to delete arbitrary files accessible to the Arc process, which runs with...
Path traversal in the Offline archives functionality of the local web interface in Arc before v2.7.0
Summary A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. Impact A local user with administrative credentials for the web interface could submit an archive name containing traversal...
CVE-2026-33922: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was discovered in the Offline archives functionality of the local web interface due to insufficient validation of an input parameter. A local user with administrative credentials for the web interface could submit an archive name containing traversal sequences and...
CVE-2025-30241
CVE-2025-30241 affects TP-Link Aginet devices; the web interface allows OS command execution due to inadequate input validation/sanitization before using system-level commands. An authenticated adjacent attacker can inject crafted input to run arbitrary commands with elevated privileges, potentia...
CVE-2025-30241 OS Command Injection in Web Interface in Multiple TP-Link Aginet Devices
Certain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system...
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
SummaryAny authenticated user with access to a terminal server could get script of their choosing to run in the Open WebUI origin itself. The HTML file preview rendered terminal-served files in an iframe whose sandbox always granted allow-same-origin alongside allow-scripts, and the file is serve...
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
SummaryIn every affected release, automation recurrence parsing anchors minutely and hourly rules at a fixed date of 2000-01-01 and then walks forward one interval at a time to find the next run. A single FREQ=MINUTELY rule therefore enumerates roughly a quarter-century of occurrences,...
CVE-2026-72570 cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename
A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...
CVE-2026-66403
DEEBOT PRO M1 and DEEBOT PRO K1VAC leave the web server for debugging purposes enabled. The floor map and log information stored on the affected products may be retrieved...
CVE-2026-17541 Bit File Manager < 6.9.1 - Unauthenticated File Activity Log Disclosure
The File Manager WordPress plugin before 6.9.1 does not have authorisation checks on one of its REST API routes, allowing unauthenticated users to read its file activity log, disclosing the file operations performed on the site, the paths involved and the name of the user who performed them...
PT-2026-69995
Name of the Vulnerable Software and Affected Versions TP-Link Aginet affected versions not specified Description Certain web interface components fail to properly validate and sanitize user-supplied input before passing it to system-level command execution functions. This allows an authenticated...
CVE-2026-72570: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...
Cisco Integrated Management Controller Cross-Site Scripting (cisco-sa-cimc-xss-7EhBFxBp)
According to its self-reported version, Cisco Integrated Management Controller is affected by a Cross-Site Scripting vulnerability. - A cross-site scripting XSS vulnerability exists in the web-based management interface of Cisco Integrated Management Controller IMC due to improper validation of...
Cisco Integrated Management Controller Argument Injection (CVE-2026-20200) (cisco-sa-cimc-arg-inject-upSHdMfU)
According to its self-reported version, Cisco Integrated Management Controller is affected by a vulnerability. - A command injection vulnerability exists in the web-based management interface of Cisco Integrated Management Controller IMC due to improper validation of user-supplied input. An...