CVE-2026-39462

CVE-2026-39462 affects SenseLive X3050, where the web management interface fails to reliably apply password changes due to backend credential handling. After factory restore with SenseLive Config 2.0, the UI may indicate a successful password update while the system continues to accept previous o...

CVE-2026-35503 SenseLive X3050 Use of Hard-coded Credentials

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rather than server-side verification. An attacker with access to the login page could retrieve these...

CVE-2026-35503

SenseLive X3050 vulnerable via its web management interface: authentication is performed client-side using hardcoded values in browser-executed scripts, enabling an attacker with access to the login page to retrieve exposed parameters and gain unauthorized administrative access. Base scores are C...

CVE-2026-25720 SenseLive X3050 Insufficient session expiration

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continu...

CVE-2026-25720

CVE-2026-25720 affects SenseLive X3050 via its web management interface, where improper session lifetime enforcement allows authenticated sessions to remain active longer than intended, enabling continued interaction with administrative functions after legitimate activity ceases. This is describe...

CVE-2026-25720

A vulnerability exists in SenseLive X3050’s web management interface due to improper session lifetime enforcement, allowing authenticated sessions to remain active for extended periods without requiring re-authentication. An attacker with access to a previously authenticated session could continu...

CVE-2026-40630

SenseLive X3050: a vulnerability in the web management interface allows an attacker with network access to bypass authentication and directly interact with sensitive configuration functions due to improper access control. Affected: SenseLive X3050 web management component; impact includes high co...

CVE-2026-1789

A vulnerability in the browser-based remote management interface may allow an administrator to access sensitive information on the device via crafted requests, affecting certain production printers and office/small office multifunction printers...

EUVD-2026-25276

A path traversal condition in Intrado 911 Emergency Gateway could allow an attacker with existing network access the ability to access the EGW management interface without authentication. Successful exploitation of this vulnerability could allow a user to read, modify, or delete files...

CVE-2026-6074

Intrado 911 Emergency Gateway EGW 5.x, 6.x, and 7.x contain a path traversal vulnerability in the downloaddebuglogfile.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory...

CVE-2026-6074

Intrado 911 Emergency Gateway EGW 5.x, 6.x, and 7.x contain a path traversal vulnerability in the downloaddebuglogfile.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory...

CVE-2026-6074

CVE-2026-6074 describes a path traversal vulnerability in the Intrado 911 Emergency Gateway (EGW). The issue arises from a malformed path (".../...//") that could allow an attacker with existing network access to reach the EGW management interface without authentication. Successful exploitation c...

CVE-2026-6074 Path traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW)

Intrado 911 Emergency Gateway EGW 5.x, 6.x, and 7.x contain a path traversal vulnerability in the downloaddebuglogfile.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory...

CVE-2026-6074 Path traversal: '.../...//' in Intrado 911 Emergency Gateway (EGW)

Intrado 911 Emergency Gateway EGW 5.x, 6.x, and 7.x contain a path traversal vulnerability in the downloaddebuglogfile.php endpoint used for Debug Logs downloads. An unauthenticated attacker can manipulate the name parameter to read arbitrary files outside the intended directory...

PT-2026-34807

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rather than server-side verification. An attacker with access to the login page could retrieve these...

KANATA CMS ALAYA SQL注入漏洞

KANATA CMS ALAYA is a digital content management platform for enterprises developed by KANATA Corporation in Japan. CMS ALAYA has a SQL injection vulnerability. This vulnerability stems from SQL injections, and it could allow attackers with access to the management interface to obtain or modify...

PT-2026-34724

Name of the Vulnerable Software and Affected Versions Intrado 911 Emergency Gateway affected versions not specified Description A path traversal condition allows an attacker with existing network access to access the EGW management interface without authentication. This could enable a user to rea...

Intrado 911 Emergency Gateway 安全漏洞

Intrado 911 Emergency Gateway is an internally deployed management device from the American company Intrado. There is a security vulnerability present in Intrado 911 Emergency Gateway, which stems from path traversal conditions. This vulnerability could allow attackers with existing network acces...

openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, allowing unauthenticated VPN access

Summary When openvpn-auth-oauth2 is deployed in the experimental plugin mode shared library loaded by OpenVPN via the plugin directive, clients that do not support WebAuth/SSO e.g., the openvpn CLI on Linux are incorrectly admitted to the VPN despite being denied by the authentication logic. The...

USN-8197-1 slurm-llnl vulnerability

It was discovered that Slurm did not properly handle access control when dealing with RPC traffic through PMI2 and PMIx, which could allow an unprivileged user to send data to an arbitrary unix socket on the host. An attacker could possibly use this issue to execute arbitrary code as the root use...