CVE-2026-47723

Nebula-mesh is affected by missing security headers in internal/web/ and internal/api/ paths prior to v0.3.1 (up to v0.3.0). The root cause is absence of standard headers such as CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security in responses, enabling cl...

Exploit for CVE-2026-63766

CVE-2026-63766 — GPT-SoVITS Unauthenticated OS Command Injecti...

Exploit for SQL Injection in Ivanti Endpoint_Manager

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL Injection to...

CVE-2026-46738

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

The vulnerability of the HTTP-handler fromAdvSetLanip in the microprogramming software for Tenda AC10 allows a attacker to execute arbitrary code, damage memory, or cause a service failure.

The vulnerability of the HTTP-handler fromAdvSetLanip in the Tenda AC10 router microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code, damage memory, or cause a service...

CVE-2026-44878

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

CVE-2026-44878 Authenticated Path Traversal allows Unauthorized Access in Web Interface

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

CVE-2026-44878

CVE-2026-44878 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS. The vulnerability in the web-based management interface allows an authenticated, highly privileged remote attacker to access the device filesystem, with potential to read sensitive files and tamper with or delet...

CVE-2026-44878 Authenticated Path Traversal allows Unauthorized Access in Web Interface

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...

PT-2026-62108

Name of the Vulnerable Software and Affected Versions ECOS affected versions not specified Description A flaw in the web-based management interface allows a highly privileged, authenticated remote attacker to access the device filesystem. This could enable the attacker to access sensitive files o...

The vulnerability of the URL processor for web interfaces in the microprogramming software for D-Link DNS-320 network storage devices allows a perpetrator to cause a service failure.

The vulnerability of the URL processor in the web interface of the D-Link DNS-320 network storage microprogramming system is related to errors in access control when processing the File parameter. Exploiting this vulnerability can allow an attacker to cause service interruptions...

CVE-2026-45713

Mailpit suffers an unauthenticated remote memory-exhaustion DoS due to missing limits on SMTP DATA and the /api/v1/send body. Before v1.30.0, Server.MaxSize is not assigned, allowing unbounded data growth and RAM/disk pressure as messages are processed and stored. Multiple sources (CVE-2026-45713...

OESA-2026-3098 cockpit security update

Cockpit makes GNU/Linux discoverable. See Linux server in a web browser and perform system tasks with a mouse. It’s easy to start containers, administer storage, configure networks, and inspect logs with this package. Security Fixes: A flaw was found in Cockpit. Deleting a sosreport with a crafte...

CVE-2026-16129

The CVE-2026-16129 entry concerns princezuda SafestClaw (Built-in Web Interface) with a flaw in ShellAction._validate_command in src/safestclaw/actions/shell.py of the Built-in Web Interface. The vulnerability is described as an incomplete blacklist in the command validation logic, enabling local...

CVE-2026-16129 princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-11826

OpenPLCv3 contains a heap-based buffer overflow in the getData function in webserver/core/modbusmaster.cpp. getData reads characters between two delimiters into a caller-supplied buffer with no size parameter and no bounds check. In parseConfig the function is invoked with the 100-byte...

CVE-2026-11826

OpenPLC_v3 has a heap-based buffer overflow in getData() within webserver/core/modbus_master.cpp. getData() copies data between delimiters into a caller-supplied buffer without size/bounds checks. parseConfig() uses a 100-byte heap-allocated MB_device.dev_name; an authenticated user can POST an o...

PT-2026-60977

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction. validate command of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-16129: Incomplete List of Disallowed Inputs

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...