CVE-2026-7395

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production...

EUVD-2026-88691

Asset Suite allows unauthenticated users to access HTTPPublishAdapterTestServlet that can be used for configuration file upload, leading to information disclosure and integrity compromise. The HTTPPublishAdapterTestServlet is specifically meant for testing purposes to be used in a non-production...

CVE-2026-7395

The Asset Suite software contains a vulnerability allowing unauthenticated users to access the HTTPPublishAdapterTestServlet . This component, intended strictly for testing in non-production environments, can be exploited to perform configuration file uploads . Successful exploitation may lead to...

BIT-GITLAB-2026-93577 Integer Overflow or Wraparound in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to an integer overflow issue when...

BIT-GITLAB-2026-89078 Double Free in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due to a double free issue when parsing a...

CVE-2026-91085

A vulnerability exists in Apache Karaf where the shell/SSH command security system fails open when no specific Access Control List (ACL) rule matches a command. Specifically, the org.apache.karaf.command.acl.config ACL lacks an entry for config:install, allowing any authenticated user—including t...

CVE-2026-86157 Exposure of Privileged IPC Functionality in Progress Telerik Fiddler Everywhere

Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker who can modify application launch parameters and persuade a user to start the application to replace the application UI or settings with attacker-controlled...

Multiple vulnerabilities in BUFFALO Wi-Fi Products

Overview The web configuration user interfaces of Wi-Fi products provided by BUFFALO INC. contain multiple vulnerabilities listed below. OS command injection CWE-78 - CVE-2026-86530 Stack-based buffer overflow CWE-121 - CVE-2026-95104 Veeti Punnonen reported these vulnerabilities to JPCERT/CC...

CVE-2026-101860

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101859

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101860 RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101860

A vulnerability exists in RaspAP raspap-webgui up to version 3.5.5 within the sudo Configuration component. The flaw is located in the PluginInstaller::addSudoers function of the file src/RaspAP/Plugins/PluginInstaller.php , where improper privilege management occurs. An attacker can initiate thi...

CVE-2026-101860 RaspAP raspap-webgui sudo Configuration PluginInstaller.php addSudoers privileges management

A vulnerability was found in RaspAP raspap-webgui up to 3.5.5. Affected by this issue is the function PluginInstaller::addSudoers of the file src/RaspAP/Plugins/PluginInstaller.php of the component sudo Configuration. Performing a manipulation results in improper privilege management. The attack...

CVE-2026-101859

A vulnerability exists in RaspAP raspap-webgui up to version 3.5.5 within the OpenVPN Configuration Handler component. The root cause is an os command injection vulnerability in the escapeshellcmd function of the ajax/openvpn/del_ovpncfg.php file. Attackers can exploit this by manipulating the cf...

CVE-2026-101859 RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

EUVD-2026-88603

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CVE-2026-101859 RaspAP raspap-webgui OpenVPN Configuration del_ovpncfg.php escapeshellcmd os command injection

A vulnerability has been found in RaspAP raspap-webgui up to 3.5.5. Affected by this vulnerability is the function escapeshellcmd of the file ajax/openvpn/delovpncfg.php of the component OpenVPN Configuration Handler. Such manipulation of the argument cfgid leads to os command injection. The atta...

CLEANSTART-2026-SP20154 ACE vulnerability in conditional configuration file processing by QOS

Security vulnerability affects the sonarqube package. ACE vulnerability in conditional configuration file processing by QOS...

EUVD-2026-88568

Nginx Proxy Manager through 2.16.0 fails to restrict the advancedconfig field to administrators, allowing non-admin users with manage permissions to inject arbitrary nginx directives. Attackers can inject malicious nginx configuration such as alias directives to serve arbitrary files or control...

EUVD-2024-55774

ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to outputfile, enabling attackers with Events view permission to access...