EUVD-2026-38284

IBM i 7.6, 7.5, 7.4, and 7.3, IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the applicatio...

Medium: httpd

Issue Overview: Use After Free vulnerability in Apache HTTP Server with modldap in per-directory configuration This issue affects Apache HTTP Server: from 2.4.0 through 2.4.67. Users are recommended to upgrade to version 2.4.68, which fixes the issue. CVE-2026-29167 A cross-site scripting...

CVE-2026-8858: Improper Control of Generation of Code

IBM WebSphere Application Server and IBM WebSphere Application Server Liberty are vulnerable to remote code execution and denial of service in the WebSphere Web Server Plug-in component. This vulnerability can be exploited when an attacker impersonates the application server and sends crafted...

The vulnerability of the setSystemAdmin() function in the embedded web server of the D-Link DCS-933L microprogramming software for IP cameras allows a intruder to execute arbitrary commands.

The vulnerability of the setSystemAdmin function in the embedded web server of the D-Link DCS-933L microprogramming software for IP cameras is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

Vulnerability of the fromP2pListFilter() function in the httpd daemon of the microprogrammed routing device Tenda F453, which allows a hacker to cause a service failure or execute arbitrary code.

The vulnerability of the fromP2pListFilter function in the Tenda F453 router microprogramming software occurs due to buffer overflow. Exploiting this vulnerability can allow a malicious actor to cause service failures or execute arbitrary code...

Exploit for Out-of-bounds Write in Tenda Ac9_Firmware

CVE-2025-29384 Proof-of-Concept Exploit Overview This repo...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the HTTP server process. An attacker can access arbitrary files on the filesystem by sending specially crafted HTTP requests containing directory traversal sequences, such as ../ or percent-encoded equivalents,...

CVE-2016-20086 Vembu StoreGrid 4.0 Unquoted Service Path Privilege Escalation

Vembu StoreGrid 4.0 contains an unquoted service path vulnerability in the RemoteBackup and RemoteBackupwebServer services that allows local attackers to escalate privileges. Attackers can place a malicious executable in the unquoted path and restart the service to execute code with LocalSystem...

SUSE CVE-2026-42530

NGINX Open Source has a vulnerability in the ngxhttpv3module module. When NGINX Open Source is configured to use the HTTP/3 QUIC module, a remote unauthenticated attacker along with conditions beyond their control can use a specially crafted HTTP/3 session to reopen a QPACK encoder stream. This m...

Lexmark Printers Cross-site Scripting (CVE-2019-18791)

Lexmark printer MS812 and multiple older generation Lexmark devices have a stored XSS vulnerability in the embedded web server. The vulnerability can be exploited to expose session credentials and other information via the users web browser. This plugin only works with Tenable.ot. Please visit...

UBUNTU-CVE-2026-42055

NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpproxyv2module and ngxhttpgrpcmodule modules. This vulnerability exists when the proxyhttpversion to 2 or grpcpass directives are used to proxy HTTP/2 traffic, the ignoreinvalidheaders directive is set to off, and the...

PT-2026-53792

Summary network-ai's ApprovalInbox lib/approval-inbox.ts is a shipped, exported, documented feature — "a web-accessible approval queue with REST API … and SSE streaming" SECURITY.md. It is the network surface of the human-in-the-loop Approval Gate, which ApprovalGate uses to require explicit huma...

Lexmark Printers Cross-site Scripting (CVE-2019-19773)

Various Lexmark products have stored XSS in the embedded web server used in older generation Lexmark devices. Affected products are available in http://support.lexmark.com/index?page=content&id=TE935&lo cale=en&userlocale=ENUS. This plugin only works with Tenable.ot. Please visit...

SOC127---SQL-Injection-Detected

SOC127---SQL-Injection-Detected detected sql injection and inv...

Security Bulletin: Multiple vulnerabilities with the Nginx web server used in IBM Aspera Shares 1.9.2 and earlier

Question Security Bulletin: Multiple vulnerabilities with the Nginx web server used in IBM Aspera Shares 1.9.2 and earlier "Business Unit":"code":"BU059","label":"IBM Software w/o TPS","Product":"code":"SS8NDZ","label":"IBM Aspera","Component":"","Platform":"code":"PF025","label":"Platform...

CVE-2026-43951

A flaw was found in Apache HTTP Server. An out-of-bounds read vulnerability exists when modheaders and modmime are used with multiple response languages. This could allow a remote attacker to disclose sensitive information from memory or cause a denial of service. Mitigation - Those who do not...

Missing Authentication for Critical Function

Overview praisonai is a PraisonAI TypeScript AI Agents Framework - Node.js, npm, and Javascript AI Agents Framework Affected versions of this package are vulnerable to Missing Authentication for Critical Function via the AgentOS HTTP server process. An attacker can access sensitive agent metadata...

Security Bulletin: IBM WebSphere Application Server shipped with Jazz for Service Management (JazzSM) is affected by multiple vulnerabilities when using the Web Server Plug-ins

Summary IBM WebSphere Application Server shipped with Jazz for Service Management JazzSM is affected by multiple vulnerabilities when using the Web Server Plug-ins CVE-2026-9072, CVE-2026-8858, CVE-2026-10852 Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

PT-2026-53125

PraisonAI recipe serve Typer command bypasses the non-localhost authentication guard Summary PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe serve dispatches to the deprecated Typer command in...

PT-2026-61772

Name of the Vulnerable Software and Affected Versions praisonaiagents versions 4.6.33 through 4.6.57 Description The HTTP server implemented via AgentTeam.launch and Agents.launch starts agent invocation endpoints that are externally reachable without authentication. The server registers the...