CVE-2026-30224

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry default ≈ 1 year...

PT-2026-23896

Name of the Vulnerable Software and Affected Versions Totolink N300RH versions 6.1.1353 B20190305 Description A flaw exists in the CGI Handler component of Totolink N300RH, specifically within the setWiFiWpsConfig function of the /cgi-bin/cstecgi.cgi file. This allows for operating system command...

[SECURITY] Fedora 44 Update: nextcloud-32.0.6-1.fc44

NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...

Fedora 45 : pcs (2026-acc29a96cf)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-acc29a96cf advisory. Automatic update for pcs-0.12.2-1.fc45. Changelog Thu Mar 5 2026 Michal Pospil - 0.12.2-1 - Rebased pcs to the newest major version see CHANGELOG.md...

CVE-2026-30223

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" local RSA public key or "authJwtHmacSecret" HMAC secret, the configured audience value authJwtAud is not enforced during toke...

CVE-2026-30225

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new...

CVE-2026-30233

Technical details for CVE-2026-30233 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2026-30225

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new...

CVE-2026-30225 OliveTin: RestartAction always runs actions as guest

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new...

CVE-2026-30224

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry default ≈ 1 year...

CVE-2026-28509

LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...

CVE-2026-28681 IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links

Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation...

CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability

LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...

CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability

LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...

The vulnerability in the web interface of the Cisco Secure Firewall Management Center (formerly known as Cisco Firepower Management Center) allows a perpetrator to execute arbitrary code with root privileges.

The vulnerability of the Web interface for managing Cisco Secure Firewall Management Center software formerly known as Cisco Firepower Management Center is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code wi...

The vulnerability of the Access Control web interface module in IP-telephony systems like FreePBX allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Access Control web interface module in IP-telephony systems like FreePBX allows attackers to compromise the confidentiality, integrity, and accessibility of protected information...

Cisco UCS Manager Software Command Injection (cisco-sa-ucsciv-wGYtC78q)

According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to perform command injection attacks...

Cisco FXOS Software Command Injection (cisco-sa-ucsciv-wGYtC78q)

According to its self-reported version, Cisco FXOS Software is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco FXOS Software could allow an authenticated, local attacker with administrative privileges to perform command injection attacks on an affecte...

Symfony-RCE

Symfony-RCE Exploit for the Symfony fragment Remote Code E...

EUVD-2026-9842

Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network...