CVE-2025-36431: Improper Neutralization of Input During Web Page Generation

IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.01 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

PT-2026-85931

Package thingsboard-tb-web-ui version 4.2.1.1-r1 fixes 2 vulnerabilities: ghsa-73rr-hh4g-fpgx, ghsa-8qq5-rm4j-mr97...

PT-2026-85933

Package thingsboard-tb-web-ui version 4.2.1.1-r2 fixes 2 vulnerabilities: ghsa-34x7-hfp2-rc4v, ghsa-r6q2-hw4h-h46w...

PT-2026-85937

Package thingsboard-tb-web-ui version 4.3.1.1-r0 fixes 1 vulnerabilities: ghsa-r4q5-vmmm-2653...

openSUSE 16 Security Update : agama-web-ui (openSUSE-SU-2026:21448-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21448-1 advisory. - CVE-2025-7783: form-data: unsafe Math.random function is used to select a boundary value for multipart form-encoded data bsc1246822. -...

CVE-2026-49258

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

CVE-2026-49258

Nebula Mesh Web UI contains ownership checks gaps in versions ≤ 0.3.5, allowing authenticated non-admin operators to access, block, or delete resources across operators via endpoints such as /ui/hosts/{id}/block, /ui/hosts/{id}, /ui/hosts, /ui/networks, and /ui/events. The root cause is improper ...

CVE-2026-49258 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)

Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...

CVE-2026-47725 nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints

nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every /ui/ POST / PUT / PATCH / DELETE route processes the request as soon as the session cookie validates. SameSite=Lax on the session cookie prevents most cross-site form submits bu...

EUVD-2026-49887

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...

qBittorrent Web UI Panel - Detect

Detects qBittorrent Web UI Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects qBittorrent Web UI Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'qBittorrent Web UI Panel - Detect',...

StackStorm Web UI - Panel Detect

StackStorm Web UI interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """StackStorm Web UI interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'StackStorm Web UI - Panel Detect',...

Detect Telerik Web UI Fileupload Handler

This template detects the Telerik Web UI fileupload handler. !/usr/bin/env python3 -- coding: utf-8 -- """This template detects the Telerik Web UI fileupload handler.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Apache JMeter Dashboard Login Panel - Detect

Detects the Apache JMeter Dashboard web UI distinct title and assets. !/usr/bin/env python3 -- coding: utf-8 -- """Apache JMeter Dashboard login panel detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Apache...

Aim Panel - Detect

Aim, an open-source, self-hosted AI/ML experiment tracking tool used to log, query, and visualize machine learning training runs, was detected by matching its distinctive web UI page title and meta description, thereby minimizing false positives associated with the generic term "Aim". !/usr/bin/e...

HashiCorp Consul Web UI Login Panel - Detect

HashiCorp Consul Web UI login panel was detected, !/usr/bin/env python3 -- coding: utf-8 -- """HashiCorp Consul Web UI login panel was detected,.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HashiCorp Consul Web U...

Headscale - Login Panel Detection

Headscale is an open-source, self-hosted implementation of the Tailscale control server. It manages WireGuard-based mesh VPN networks and exposes a web UI for administration. !/usr/bin/env python3 -- coding: utf-8 -- """Headscale is an open-source, self-hosted implementation of the Tailscale...

H2O Driverless AI Panel - Detect

H2O Driverless AI, a commercial automated machine learning AutoML platform that provides a web UI typically served on port 12345 for building and deploying machine learning models, was detected. An exposed H2O Driverless AI login panel was identified. It is distinct from H2O Wave and H2O-3/Flow,...

Kubeflow Pipelines Panel - Detect

Kubeflow Pipelines is an open-source platform for building and deploying portable, scalable ML workflows. It provides a web UI for managing ML pipelines, experiments, and runs on Kubernetes. !/usr/bin/env python3 -- coding: utf-8 -- """Kubeflow Pipelines is an open-source platform for building an...

Kubeflow Katib Panel - Detect

Kubeflow Katib, a Kubernetes-native project for automated machine learning AutoML that performs hyperparameter tuning, early stopping, and neural architecture search, was detected. Its web UI is normally served under the /katib/ path behind the Kubeflow Central Dashboard, fronted by an Istio/OIDC...