CVE-2026-104080 Control Web Panel (CWP) < 1.29 OS Command Injection via valid_token

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API /validtoken/ route that allows unauthenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the unvalidated 'user' parameter. Attackers ca...

EUVD-2026-115247

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77880

Control Web Panel (CWP) versions before 1.16 are vulnerable to an OS command injection in the loopback API password change route /newpass/. The flaw exists because the POST user parameter is passed unescaped into a shell command that runs with root privileges . An attacker can exploit this to inj...

CVE-2026-77880 Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/

Control Web Panel CWP before webpanelversion 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell...

CVE-2026-77878

Control Web Panel (CWP) versions prior to webpanel_version 1.30 are vulnerable to an OS command injection vulnerability. The flaw exists in the loopback API database restore route, specifically within the restoreDBBackup() handler of the /v1/restoredatabase/ endpoint. The root cause is the failur...

EUVD-2026-115245

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77878 Control Web Panel (CWP) < 1.30 OS Command Injection via restoredatabase API

Control Web Panel CWP before webpanelversion 1.30 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77878 Control Web Panel (CWP) < 1.29 OS Command Injection via restoredatabase API

Control Web Panel CWP before webpanelversion 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/, where the restoreDBBackup handler passes an attacker-controlled file path from the POST body into a shell command without proper...

CVE-2026-77877 Control Web Panel (CWP) < 1.30 Unauthenticated Loopback API Root Access

Control Web Panel CWP before webpanelversion 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

CVE-2026-77877 Control Web Panel (CWP) < 1.29 Unauthenticated Loopback API Root Access

Control Web Panel CWP before webpanelversion 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

CVE-2026-77877

Control Web Panel (CWP) versions prior to webpanel_version 1.30 are vulnerable to a missing authentication flaw in the loopback API service. This vulnerability allows an attacker who can reach the loopback API to invoke root-privileged API routes without an access token. Specific exploitable endp...

EUVD-2026-115244

Control Web Panel CWP before webpanelversion 1.30 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. Attackers can access endpoints such as /v1/restoredatabase/,...

CVE-2026-73696

Control Web Panel CWP before webpanelversion 1.12 contains an execution after redirect vulnerability in the user panel authentication flow CWPUserIndex that allows unauthenticated attackers to bypass authentication by exploiting a missing exit call after a header'Location: ...' redirect. Attacker...

Exploit for CVE-2026-98432

Checks whether a Linux host may be exposed to CVE-2026-98432...

CVE-2026-73696 Control Web Panel (CWP) < 1.12 Execution After Redirect in CWPUserIndex

Control Web Panel CWP before webpanelversion 1.12 contains an execution after redirect vulnerability in the user panel authentication flow CWPUserIndex that allows unauthenticated attackers to bypass authentication by exploiting a missing exit call after a header'Location: ...' redirect. Attacker...

CVE-2026-73696

Control Web Panel (CWP) versions prior to webpanel_version 1.12 are vulnerable to an execution after redirect (EAR) vulnerability within the CWPUserIndex authentication flow. The root cause is a missing exit() call following a header('Location: ...') redirect, which allows unauthenticated attacke...

EUVD-2026-115228

Control Web Panel CWP before webpanelversion 1.12 contains an execution after redirect vulnerability in the user panel authentication flow CWPUserIndex that allows unauthenticated attackers to bypass authentication by exploiting a missing exit call after a header'Location: ...' redirect. Attacker...

ROOT-APP-PYPI-CVE-2026-27459 CVE-2026-27459 in pyOpenSSL - Patched by Root

Root has patched CVE-2026-27459 in the pyOpenSSL package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-59939 CVE-2026-59939 in httplib2 - Patched by Root

Root has patched CVE-2026-59939 in the httplib2 package for Root:PyPI. Multiple fixed versions available...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions The key descriptions in cifs.idmap contain authority-bearing fields—owner and group SIDs, as well as uid/gid values in “os:”, “gs:”, “oi:”, and “gi:” formats—that the cifs.idm...