NethServer WebTop 1.5.6 Cross Site Scripting

NethServer WebTop module versions 1.5.6 and below suffer from two persistent cross site scripting vulnerabilities...

CVE-2026-75548: Improper Restriction of Rendered UI Layers or Frames

The affected Ebyte device web management interface does not restrict the interface from being rendered within an external frame. An unauthenticated remote attacker could use a crafted webpage to mislead an authenticated administrator into initiating unintended configuration changes or disruptive...

PT-2026-82506

Name of the Vulnerable Software and Affected Versions syWEB versions prior to 27082026 Description Improper neutralization of input during web page generation in syWEB allows Reflected XSS, a type of cross-site scripting where malicious scripts are reflected off a web application to the victim's...

PT-2026-82798

Xiiaozet LK100W is vulnerable to OS command injection through its web-based management interface. An authenticated attacker may be able to execute arbitrary operating system commands with elevated privileges, potentially resulting in unauthorized access to sensitive information or complete device...

CVE-2026-78293: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP w3all phpBB = 3.0.6 versions...

PT-2026-82780

Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 version FW-9167-0-11 Ebyte NA111-M affected versions not specified Description The web management interface fails to consistently enforce authentication before granting access to administrative functionality. This allows an...

PT-2026-82838

Name of the Vulnerable Software and Affected Versions WatchGuard Fireware OS affected versions not specified Description A buffer overflow in the Management Web UI allows an authenticated administrator with network access to trigger a denial of service DoS condition or potentially execute arbitra...

PT-2026-82856

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

PT-2026-82850

WatchGuard Dimension's Web UI exposes an administrator passphrase change action that lacks CSRF protection. An attacker who can induce an authenticated global administrator's browser to visit a crafted link or page can change that administrator's passphrase to an attacker-chosen value without the...

PT-2026-82781

Name of the Vulnerable Software and Affected Versions Ebyte gateway products affected versions not specified Description Certain gateway products transmit sensitive information in cleartext because the web management interface lacks adequate transport-layer encryption. This allows an attacker wit...

PT-2026-82791

Name of the Vulnerable Software and Affected Versions Ebyte gateway products affected versions not specified Description Improper protection of authentication tokens in the web management interface occurs during client-side session handling. This flaw allows an attacker who obtains exposed sessio...

PT-2026-82788

Name of the Vulnerable Software and Affected Versions Ebyte NE2-D11 affected versions not specified Description The web management interface of the device fails to restrict the interface from being rendered within an external frame. This allows an unauthenticated remote attacker to use a crafted...

CVE-2026-78273: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-5738: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in BilPark Informatics Technologies Industry and Trade Inc. DoXBASE allows Cross Zone Scripting. This issue affects DoXBASE: through 27082026. NOTE: The vendor was contacted early about this disclosur...

CVE-2026-75418

A path traversal vulnerability exists in the built-in preview/development web server of Lektor 3.3.14 on Windows. An attacker with network access to the server can send a crafted HTTP request containing path traversal sequences to read arbitrary files accessible to the process, disclosing sensiti...

Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

CVE-2026-43795

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2026-43794

A flaw was found in WebKitGTK. Processing malicious web content can cause a memory corruption issue due to improper memory handling. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...

CVE-2026-65341

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server,...

CVE-2026-64780

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper validation checks. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4:...