Dormakaba Access Manager security vulnerabilities

The Dormakaba Access Manager is a smart hardware controller developed by the Dormakaba company in the United States. There is a security vulnerability in the Dormakaba Access Manager, which stems from the Web server binary running with root privileges, potentially leading to an increase in...

PT-2026-4752

The web server of the Access Manager offers a functionality to download a backup of the local database stored on the device. This database contains the whole configuration. This includes encrypted MIFARE keys, card data, user PINs and much more. The PINs are even stored unencrypted. Combined with...

Hiawatha security vulnerabilities

Hiawatha is a security web server developed by Hugo Leisink for Unix systems. This product can prevent attacks such as XSS, SQL injection, and CSRF, and it also offers server monitoring capabilities. Version 11.7 of Hiawatha contains a security vulnerability caused by the use of strcmp, which may...

PT-2026-4756

Name of the Vulnerable Software and Affected Versions affected versions not specified Description The binary responsible for serving the web server and executing actions initiated from the Web UI operates with root privileges, violating the principle of least privilege. Successful code execution ...

CVE-2026-24423

SmarterTools SmarterMail versions prior to build 9511 contain an unauthenticated remote code execution vulnerability in the ConnectToHub API method. The attacker could point the SmarterMail to the malicious HTTP server, which serves the malicious OS command. This command will be executed by the...

PT-2026-4762

CVE-2026-24644 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2026-24644 Published : Jan. 24, 2026, 4:15 a.m. | 1 hour, 8 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

CVE-2021-47903 LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path...

CVE-2021-47903 LiteSpeed Web Server Enterprise 5.4.11 - Command Injection

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path...

CVE-2021-47903

LiteSpeed Web Server Enterprise version 5.4.11 has an authenticated command injection vulnerability in the external app configuration interface. A user with administrative privileges can inject shell commands via the Command parameter, enabling remote code execution through path traversal and bas...

CVE-2021-47903

LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated administrators can inject shell commands through the 'Command' parameter in the server configuration, allowing remote code execution via path...

PT-2026-4633

CVE-2026-24334 - Apache HTTP Server Cross-Site Request Forgery CVE ID : CVE-2026-24334 Published : Jan. 23, 2026, 5:16 a.m. | 1 hour, 58 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and...

PT-2026-4635

CVE-2026-24336 - Apache HTTP Server Unvalidated User Input CVE ID : CVE-2026-24336 Published : Jan. 23, 2026, 5:16 a.m. | 1 hour, 58 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

PT-2026-4641

CVE-2026-24342 - Apache HTTP Server Remote Code Execution CVE ID : CVE-2026-24342 Published : Jan. 23, 2026, 5:16 a.m. | 1 hour, 58 minutes ago Description : Rejected reason: Not used Severity: 0.0 | NA Visit the link for more details, such as CVSS details, affected products, timeline, and more...

📄 Cacti Graph Template Authenticated Remote Code Execution

This Metasploit module exploits an authenticated remote code execution vulnerability in Cacti versions prior to 1.2.29. Authenticated users can upload a graph template through the /graphtemplates.php endpoint. The rightaxislabel parameter is vulnerable to code injection, allowing attackers to...

PT-2026-4676

CVE-2026-21867 - Apache Web Server Remote Code Execution CVE ID : CVE-2026-21867 Published : Jan. 23, 2026, 7:15 p.m. | 4 hours, 6 minutes ago Description : Rejected reason: Reason: This candidate was issued in error. Severity: 0.0 | NA Visit the link for more details, such as CVSS details,...

LiteSpeed Web Server Enterprise security vulnerabilities

LiteSpeed Web Server Enterprise is a server software developed by LiteSpeed Corporation in the United States. Version 5.4.11 of LiteSpeed Web Server Enterprise contains a security vulnerability, which stems from command injection in the external application configuration interface. This...

CVE-2025-50002

Unrestricted Upload of File with Dangerous Type vulnerability in Farost Energia energia allows Upload a Web Shell to a Web Server.This issue affects Energia: from n/a through = 1.1.2...

PT-2026-4628

CVE-2024-53250 - Apache HTTP Server Cross-Site Scripting CVE ID : CVE-2024-53250 Published : Jan. 22, 2026, 10:16 a.m. | 50 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. Severity: 0.0 | NA Visit the link for more details, such as CVSS...

PT-2026-4629

CVE-2024-53251 - Apache HTTP Server Remote Buffer Overflow CVE ID : CVE-2024-53251 Published : Jan. 22, 2026, 10:16 a.m. | 50 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. Severity: 0.0 | NA Visit the link for more details, such as CVS...

PT-2026-4612

CVE-2024-36998 - Apache HTTP Server SQL Injection CVE ID : CVE-2024-36998 Published : Jan. 22, 2026, 10:16 a.m. | 50 minutes ago Description : Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. The CVE was never used. Severity: 0.0 | NA Visit the link for more details, such as CVSS details...