CVE-2026-3227-TP-Link-authenticated-RCE

CVE-2026-3227: TP-लिंक राउटर OS कमांड इंजेक्शन अधिक जानकारी के लिए देखें https://vulners.com/cve/CVE-2026-3227 एक स्थायी, प्रमाणित OS कमांड इंजेक्शन भेद्यता TP-लिंक राउटर फर्मवेयर में जो डिवाइस को ब्रिक करने या संभावित LAN अधिग्रहण की ओर ले जाती है। अस्वीकरण : इस रिपॉजिटरी में एक पैच की गई भेद्यत...

Tattile Camera < 1.181.5 - Default Login

Tattile Smart+, Vega, and Basic device families firmware = 1.181.5 contain a broken authentication caused by default credentials not forced to be changed, letting attackers with management interface access gain administrative privileges. id: CVE-2026-26341 info: name: Tattile Camera 1.181.5 -...

ZTE Cable Modem Web Shell

ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to webshellcmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author:...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

Zyxel - Authentication Bypass

An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware...

CData Connect < 23.4.8846 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Connect 23.4.8846 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31849 info: name: CData Connect 23.4.8846...

WeGIA <= 3.6.4 - Remote Code Execution

WeGIA = 3.6.5 contains a remote code execution caused by improper validation of backup file names in the database restoration functionality, letting attackers with administrative access execute arbitrary OS commands id: CVE-2026-28409 info: name: WeGIA = 3.6.4 - Remote Code Execution author:...

TOTOLINK A3002RU 1.0.8 - Information Disclosure

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for password.htm. This allows remote attackers to gain administrative access without credentials. id: CVE-2018-13317 info: name:...

EUVD-2026-57454

SiYuan: The session-cookie signing key Conf.CookieKey is returned to anonymous readers by /api/system/getConf...

CVE-2026-12878

A flaw was found in the Codefresh platform. An authenticated user can exploit an API endpoint to elevate their privileges to administrative permissions, potentially gaining full control over the platform...

CVE-2025-8730

CVE-2025-8730 – बेल्किन F9K1009/F9K1010 में प्रमाणीकरण बाईपास लेखक : Byte Reaper विवरण : यह रिपॉजिटरी CVE-2025-8730 के लिए एक शोषण exploit प्रस्तुत करता है, जो बेल्किन F9K1009 और F9K1010 राउटर्स के वेब इंटरफेस को प्रभावित करने वाली एक गंभीर प्रमाणीकरण बाईपास भेद्यता है। यह दोष /login.htm फ़ाइल की...

sadcloud

Sadcloud sadcloud is a tool for spinning up insecure AWS infrastructure with Terraform. It supports approx. 84 misconfigurations across 22 AWS Services. The inital set of misconfigurations were drawn from ScoutSuite, NCCGroup's Multi-cloud auditing tool. sadcloud was created to easily allow...

CVE-2026-85174

SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timing thresholds. Authenticated attackers can read the log file via the getFile endpoint to recover admin API tokens and gain permanent administrative access...

CVE-2026-41940

الثغرة الأمنية CVE-2026-41940 في cPanel/WHM أثارت الثغرة الأمنية الحديثة CVE-2026-41940 قلقًا كبيرًا لدى مسؤولي الخوادم الذين يستخدمون cPanel/WHM. وهي عيب خطير يمكن أن يسمح بتجاوز المصادقة، مما يتيح الوصول غير المصرح به إلى لوحة الإدارة دون بيانات اعتماد صالحة. نظرًا لأن WHM هو نقطة التحكم الرئيس...

CVE-2026-73766 Authenticated Command Injection Vulnerabilities in the API Endpoint of AOS-CX

Command injection vulnerabilities in the API endpoint of AOS-CX could allow an authenticated remote attacker with administrative privileges to inject arbitrary commands. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on the underlying operating...

CVE-2026-76658

A vulnerability has been identified in the SSH daemon of HPE Networking Fabric Composer that could allow an unauthenticated remote attacker to gain administrative access to vulnerable AFC hosts. Successful exploitation could allow an attacker to execute arbitrary commands as a privileged user on...

CVE-2026-73726

A vulnerability has been identified in the underlying operating system of HPE Networking Fabric Composer that could potentially allow an unauthenticated adjacent actor to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative access,...

CVE-2026-76657 Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access

Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete...

CVE-2026-76657 Authentication Bypass in HPE Networking Fabric Composer API allows Administrative Access

Vulnerabilities have been identified in the API of HPE Networking Fabric Composer that could potentially allow an unauthenticated remote attacker to circumvent existing authentication controls. Successful exploitation could allow an attacker to gain administrative privileges leading to complete...

CVE-2026-73748 Authenticated Sensitive Information Disclosure in HPE Networking Fabric Composer

A vulnerability in the affected interface of HPE Networking Fabric Composer allows an attacker with administrative privileges to access sensitive information in a cleartext format. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further acce...