CVE-2026-73734: URL Redirection to Untrusted Site

A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to redirect users to an arbitrary URL...

CVE-2026-73722: Improper Neutralization of Special Elements used in an OS Command

Command injection vulnerabilities in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated remote attacker to perform command injection against the affected system. Successful exploitation could allow an attacker to execute arbitrary commands as a...

CVE-2026-73723: Incorrect Authorization

A privilege escalation vulnerability exists in the web-based management interface of HPE Networking Fabric Composer. Successful exploitation could allow an authenticated low privilege operator user to complete state-changing actions that should not be allowed by their current level of authorizati...

CVE-2026-78037: Improper Neutralization of Special Elements used in an OS Command

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-78387

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2026-78387: Missing Authorization

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

CVE-2026-31880: Improper Neutralization of Input During Web Page Generation

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the universal search. This issue has been fixed in version 3.2.3...

CVE-2026-30865: Improper Neutralization of Input During Web Page Generation

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the dashboard save functionality. This issue has been fixed in version 3.2.3...

CVE-2026-30826: Improper Neutralization of Input During Web Page Generation

Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there is a Reflected Cross-Site Scripting XSS vulnerability in the testing OQL query functionality. This issue has been fixed in version 3.2.3...

CVE-2026-20327: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, local attacker to perform a blind SQL injection attack against an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker coul...

CVE-2026-20232: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

CVE-2026-57469: Cross-Site Request Forgery (CSRF)

Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery CSRF vulnerability in the web-based configuration backend of KUNBUS PiCtory in version 2.16.0 that allows a remote unauthenticated attacker to perform state-changing operations in the context of an authenticated operator,...

CVE-2026-20288

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...

CVE-2026-20294 Cisco Catalyst SD-WAN Manager Information Disclosure Vulnerability

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types...

PT-2026-68231

Name of the Vulnerable Software and Affected Versions Cisco Integrated Management Controller IMC affected versions not specified Description An issue in the web-based management interface allows an authenticated remote attacker to perform a cross-site scripting XSS attack. This occurs due to...

PT-2026-68249

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description Insufficient error handling in the web-based management interface allows an authenticated remote attacker with low privileges to trigger a denial of service DoS condition. The...

PT-2026-68247

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description Insufficient input validation in the web-based management interface allows an authenticated remote attacker with low privileges to execute a denial of service DoS attack. By...

PT-2026-68243

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager affected versions not specified Description An issue in the web-based management interface allows an authenticated, remote attacker to view sensitive information in clear text. This occurs due to insufficient acce...

CVE-2026-20200: Improper Neutralization of Parameter/Argument Delimiters

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with low privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...

CVE-2026-20311: Buffer Over-read

A vulnerability in the web-based management interface of Cisco IOS XE Software could allow an authenticated, remote attacker with low privileges to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient error handling in the web-based management...