CVE-2026-126474

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the moduleid parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script...

CVE-2024-31964

CVE-2024-31964 CVE-2024-31964 PoC: Mitel 6900w Series SIP Phone - Temporary Authentication Bypass Vulnerability details Summary It consists of a temporary authentication bypass vulnerability in the HTTP administrative website panel of several Mitel Products. Impact Allows an attacker to modify th...

CVE-2021-42562

CVE-2021-42562: Improper Access Control in MITRE Caldera Caldera versions =2.8.1 does not properly segregate user privileges, resulting in non-admin users having access to read and modify configuration or other components which should only be accessible by admin users. Vendor Disclosure: The...

Dji_ble_vuln

CVE-2026-78306 — DJI Drone DUML Command Injection over Bluetooth POC CVE record: https://vulners.com/cve/CVE-2026-78306 NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-78306 Description DJI drones expose a Bluetooth interface used to establish a connection to the drone's Wi-Fi interface and exchan...

CVE-2021-40113

CVE-2021-40113 Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network PON Series Switches Optical Network Terminal ONT could allow an unauthenticated, remote attacker to perform the following actions: Log in with a default credential if the...

EUVD-2026-123058

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-20183

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-20183 ISE Authorization Bypass vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-20183

A vulnerability exists in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC) . The issue stems from a lack of server-side validation of Administrator permissions , which could allow an authenticated, remote attacker to mod...

CVE-2020-11107

CVE-2020-11107 This is a writeup for CVE-2020-11107 I've found. An issue was discovered in XAMPP before 7.2.29, 7.3.x before 7.3.16 , and 7.4.x before 7.4.4 on Windows. An unprivileged user can change a .exe configuration in xampp-contol.ini for all users including admins to enable arbitrary...

PT-2026-144858

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to modify parts of the configuration on an affected device. This vulnerability is due to the lack of server-side validation of Administrator permissions. An...

CVE-2026-120113

IBM Aspera Connect versions 1.6.1 through 4.2.19 are vulnerable to multiple security issues (CVE-2026-120113) due to missing authentication and overly permissive cross-origin access controls within the local HTTP service. A remote attacker could trick a victim into visiting a malicious webpage to...

EUVD-2026-119680

IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web pag...

CVE-2026-120113 Multiple vulnerabilities in IBM Aspera Connect

IBM Aspera Connect 1.6.1 through 4.2.19 could allow a remote attacker to obtain sensitive information and modify host trust configuration due to missing authentication and overly permissive cross-origin access controls in the local HTTP service. By persuading a victim to visit a malicious web pag...

HP Poly EagleEye Cube USB security vulnerability

The HP Poly EagleEye Cube USB version 1.3.1-001267 contains a security vulnerability. This vulnerability arises because session management and access control are not enforced at the device level within the administrator authentication process. Unauthenticated attackers can modify the client to...

CVE-2026-105993

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options...

EUVD-2026-115679

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options...

PT-2026-136027

The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unauthenticated attackers to modify the DT Directory Lite Addon WordPress plugin through 1.1's configuration and skin options...

Matthias Klass and FHEM security vulnerabilities

A security vulnerability exists in Matthias Klass’s FHEM version 2.4.1. This vulnerability stems from improper permission settings and may allow unauthorized attackers to freely modify other users’ FHEM home automation configurations...

CVE-2026-116672

A flaw was found in Authlib. An authenticated remote attacker can bypass authorization controls to access, modify, or delete configurations belonging to other clients. In deployments implementing the documented reference code for dynamic client configuration, the server validates client editabili...