CVE-2026-49973: Missing Authentication for Critical Function

Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the setpassword parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable netwo...

CVE-1999-1559: Undefined Security Weakness

Xylan OmniSwitch before 3.2.6 allows remote attackers to bypass the login prompt via a CTRL-D control d character, which locks other users out of the switch because it only supports one session at a time...