90822 matches found
CVE-2026-27553: Exposure of Sensitive System Information to an Unauthorized Control Sphere
A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnosticstab/ajaxdiagtablerows endpoint using a valid user cookie allowing disclosure of all user password hashes...
CVE-2026-27552: Incorrect Authorization
A low-privileged remote attacker can exploit improper authorization in the /index.php/attacheddevicestab/doupload endpoint to upload IODD files to the device, potentially altering device behavior or causing system crashes...
CVE-2026-27551: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user credentials allowing execution of commands with root privileges on the device...
CVE-2026-27547: Improper Neutralization of Special Elements used in an OS Command
A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/getioddmenuinfo endpoint using valid user or operator credentials allowing execution of commands with root privileges on the device...
CVE-2026-27560: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE request with admin credentials allowing execution of commands with root privileges on the device...
CVE-2026-76409: Improper Limitation of a Pathname to a Restricted Directory
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...
CVE-2026-27565: Improper Neutralization of Special Elements used in an OS Command
An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell script remains active even after a reboot...
CVE-2026-27561: Improper Neutralization of Special Elements used in an OS Command
A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET request with admin credentials allowing execution of commands with root privileges on the device...
CVE-2026-20361: Improper Neutralization of Special Elements used in an SQL Command
As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that addresses multiple internally discovered vulnerabilities. T...
CVE-2026-92815: Server-Side Request Forgery (SSRF)
changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access internal addresses. Attackers can supply arbitrary internal URLs in the optionalvalue parameter to retrieve responses from restricted network locations...
CVE-2026-87105: Improper Neutralization of Special Elements used in an SQL Command
Tanium addressed a SQL injection vulnerability in Threat Response...
CVE-2026-92800: Insufficient Session Expiration
Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with revoked access can retain real-time read and write access to sub-documents through open websocket sessions that are never disconnected...
CVE-2026-92132: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Jenkins Gradle Plugin 2.19.1252.v15196b5a6e10 and earlier requests build scan data from the build scan link detected in the build log, even when a Develocity server URL is configured in the global configuration, allowing attackers able to control the build log to capture the Develocity access key...
CVE-2026-73468: Always-Incorrect Control Flow Implementation
A specially crafted packet can cause the premature expiry of multicast forwarding state on affected interfaces, potentially resulting in temporary multicast traffic loss during the affected period...
CVE-2026-68536: Server-Side Request Forgery (SSRF)
Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue...
CVE-2026-87113: Authorization Bypass Through User-Controlled Key
Tanium addressed an improper access controls vulnerability in Threat Response...
CVE-2026-89084: Improper Limitation of a Pathname to a Restricted Directory
HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software...
CVE-2026-27557: Path Traversal: '.../...//'
An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/viewuploadedioddfile endpoint allowing the SSH server's private keys to be read...
CVE-2026-89083: Improper Control of Generation of Code
HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code execution, or arbitrary file write under certain conditions, impacting the HP Advance server hosting the software...