EUVD-2026-3652

Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise Packaged CCE and Cisco Unified Contact Center Enterprise Unified CCE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-base...

PT-2026-3786

Multiple vulnerabilities in the web-based management interface of Cisco Packaged Contact Center Enterprise Packaged CCE and Cisco Unified Contact Center Enterprise Unified CCE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the web-base...

HPE Aruba Networking EdgeConnect SD-WAN Orchestrator XSS

The vulnerability of the web interface of the software-defined networking management software HPE Aruba Networking EdgeConnect SD-WAN Orchestrator is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting...

HPE Aruba Networking EdgeConnect SD-WAN Orchestrator SQLi

The vulnerability of the web interface of the software-defined networking management software HPE Aruba Networking EdgeConnect SD-WAN Orchestrator is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute SQL...

HPE Aruba Networking EdgeConnect SD-WAN Orchestrator SQLi

The vulnerability in the web interface of the software-defined networking management software HPE Aruba Networking EdgeConnect SD-WAN Orchestrator is related to the lack of security measures for the SQL query structure. Exploiting this vulnerability allows a remote attacker to execute SQL...

CVE-2026-0622 Open 5GS WebUI uses a hard-coded JWT signing key

Open 5GS WebUI uses a hard-coded JWT signing key change-me whenever the environment variable JWTSECRETKEY is unset...

CVE-2025-36408

IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-33015

IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface...

CVE-2025-33015

IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface...

CVE-2026-0554 NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset

The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' REST API endpoints in all versions up to, and including, 3.1.11. This makes it possible for authenticated attackers, with Contributor-level...

PT-2026-3622

IBM Application Gateway 23.10 through 25.09 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

IBM ApplinX cross-site scripting vulnerability

IBM ApplinX is a product of American International Business Machines IBM that focuses on converting green-screen interfaces into modern web-based applications. Version 11.1 of IBM ApplinX contains a cross-site scripting vulnerability. This vulnerability arises because authenticated users can embe...

PT-2026-3584

IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface...

IBM Concert 代码问题漏洞

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. IBM Concert suffers from a code issue vulnerability that stems from not validating the content of files uploaded to the web interface, which can be...

PT-2026-3645

Name of the Vulnerable Software and Affected Versions Open 5GS WebUI affected versions not specified Description The software utilizes a hard-coded JWT signing key 'change-me' if the JWT SECRET KEY environment variable is not set. This can allow attackers to forge JWTs and potentially gain...

CVE-2025-33015: Unrestricted Upload of File with Dangerous Type

IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface...

PT-2026-3624

IBM ApplinX 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Browan Communications PrismX MX100 security vulnerabilities

The Browan Communications PrismX MX100 is a wireless router produced by Browan Communications in Taiwan, China. The Browan Communications PrismX MX100 has a security vulnerability, which stems from insufficient credential protection. This vulnerability could allow privileged remote attackers to...

MiracleLinux 9 : cockpit-311.2-1.el9_4.ML.1 (AXSA:2024-8451:13)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2024-8451:13 advisory. cockpit: command injection when deleting a sosreport with a crafted name CVE-2024-2947 CVE-2024-2947 A flaw was found in Cockpit. Deleting a sosreport with a...

EUVD-2026-3223

A vulnerability was found in Totolink LR350 9.3.5u.6369B20220309. Affected by this vulnerability is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ssid results in buffer overflow. The attack may be performed from remote. The exploit has been ma...