EUVD-2026-48744

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

CVE-2026-61884

The web management interface of Tycon Systems TPDIN-Monitor-WEB2 does not perform server-side validation of credentials during the login process. By submitting empty values for both credential fields, an unauthenticated remote attacker can bypass the authentication check and establish a valid...

CVE-2026-55985

The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...

EUVD-2026-42650

open-webui terminal proxy path traversal guard bypass via 9x encoded traversal...

EUVD-2026-42639

Open WebUI: Arena task endpoints can bypass underlying model access controls...

EUVD-2026-42628

Open WebUI: Upload metadata.knowledgeid bypasses the knowledge-base write-access check read-only users can add files to KB...

EUVD-2026-42627

Open WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller sessionid...

EUVD-2026-42617

Open WebUI: Account enumeration via observable login timing discrepancy...

CVE-2026-47723

Nebula-mesh is affected by missing security headers in internal/web/ and internal/api/ paths prior to v0.3.1 (up to v0.3.0). The root cause is absence of standard headers such as CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Strict-Transport-Security in responses, enabling cl...

Exploit for CVE-2026-63766

CVE-2026-63766 — GPT-SoVITS Unauthenticated OS Command Injecti...

Exploit for SQL Injection in Ivanti Endpoint_Manager

CVE-2024-50330: Ivanti Endpoint Manager EPM SQL Injection to...

CVE-2026-46738

Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contains an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges...

AdvSetLanip HTTP Handler Heap Buffer Overflow DoS

The vulnerability of the HTTP-handler fromAdvSetLanip in the Tenda AC10 router microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code, damage memory, or cause a service...

CVE-2026-44878

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

CVE-2026-44878 Authenticated Path Traversal allows Unauthorized Access in Web Interface

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

CVE-2026-44878

CVE-2026-44878 affects HPE Aruba Networking EdgeConnect SD-WAN Gateways running ECOS. The vulnerability in the web-based management interface allows an authenticated, highly privileged remote attacker to access the device filesystem, with potential to read sensitive files and tamper with or delet...

CVE-2026-44878 Authenticated Path Traversal allows Unauthorized Access in Web Interface

A vulnerability in the web-based management interface of an ECOS device could allow a highly privileged, authenticated remote attacker to access the device's filesystem. Successful exploitation of this vulnerability could allow an attacker to access sensitive files and tamper with or delete syste...

Arbitrary File Upload

Overview Affected versions of this package are vulnerable to Arbitrary File Upload through the web release edit process. An attacker can bypass configured file extension restrictions by renaming existing release attachments to forbidden extensions via the web interface, allowing the distribution ...

PT-2026-62108

Name of the Vulnerable Software and Affected Versions ECOS affected versions not specified Description A flaw in the web-based management interface allows a highly privileged, authenticated remote attacker to access the device filesystem. This could enable the attacker to access sensitive files o...

D-Link DNS-320 DoS

The vulnerability of the URL processor in the web interface of the D-Link DNS-320 network storage microprogramming system is related to errors in access control when processing the File parameter. Exploiting this vulnerability can allow an attacker to cause service interruptions...