CVE-2026-1840

The CVE concerns Hubbell Aclara Metrum Cellular Web Interface, where unauthorized access arises from missing authentication on critical system functions. This allows attackers to alter essential configuration settings, trigger system restarts, and potentially disrupt device communications. CISA a...

CVE-2026-1840 Missing authentication for critical function in Hubbell Aclara Metrum Cellular Web Interface

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without...

Astra Linux – Vulnerability in qBittTorrent

All versions of the qBittorrent client up to 4.5.5 use default credentials when the web user interface is enabled. Administrators are not forced to change the default credentials. As of 4.5.5, this issue has not been fixed. A remote attacker can use the default credentials to authenticate and...

OESA-2026-2731 mercurial security update

Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface. Security Fixes: A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects...

OESA-2026-2729 mercurial security update

Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface. Security Fixes: A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects...

OESA-2026-2730 mercurial security update

Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface. Security Fixes: A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects...

CVE-2026-1840: Missing Authentication for Critical Function

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without...

The vulnerability in the web interface of the operating system PAN-OS for network interfaces of the PA-Series, VM-Series, and virtual devices of the M-Series series allows a perpetrator to execute arbitrary code.

The vulnerability of the PAN-OS operating system’s web interface for PA-Series, VM-Series, and M-Series virtual devices is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EUVD-2026-38535

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/v1/calendars/events/eventid/update validates that the caller has write access to the calendar the event currently belongs to, but does not validate the destination calendar...

CVE-2026-54019

Open WebUI CVE-2026-54019 describes an ACL bypass in Milvus multitenancy mode. Before version 0.9.6, collection-level ACL checks exist but can be bypassed when an attacker supplies user-controlled, unknown collection names, which Milvus treats as a resource_id and interpolates into an unsafe expr...

Hubbell Aclara Metrum Cellular Web Interface

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow attackers to manipulate critical device settings and repeatedly disrupt operations, potentially causing a loss of communications to the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

VulnCheck KEV: CVE-2025-67038

Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges...

PT-2026-51645

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1 Description An authenticated user with generic asset edit permissions can delete files attached to assets regardless of ownership or company assignment. This is caused by an Insecure Direct Object Reference IDO...

The vulnerability in the web interface for managing microprogrammed software routers UTT HiPER 1250GW allows a hacker to trigger a service failure.

The vulnerability of the web-based management interface for UTT HiPER 1250GW microprogramming software is related to buffer overflow in the stack when processing the Profile parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the web interface for managing micro-program software-based network devices UTT 1200GW allows a perpetrator to cause a service failure.

The vulnerability of the web-based interface for managing microprogrammed network devices UTT 1200GW is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability in the web interface for managing microprogrammed software routers UTT HiPER 1250GW allows a hacker to trigger a service failure.

The vulnerability of the web-based management interface for UTT HiPER 1250GW microprogramming software is related to buffer overflow in the stack when processing the Profile parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the web interface for managing microprogrammed network devices UTT 1200GW allows a perpetrator to cause a service failure.

The vulnerability in the web interface for managing microprogrammed network devices UTT 1200GW is related to the data being written beyond the buffer boundaries in memory when processing the sysAdmUser/sysAdmPass parameter. Exploitation of this vulnerability could allow a malicious actor to cause...

EUVD-2026-0815

ComfyUI-Manager has an Unprotected Alternate Channel CWE-420...

GHSA-95PQ-HR8P-F5G7 ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

Impact An Unprotected Alternate Channel CWE-420 vulnerability was discovered in ComfyUI-Manager versions prior to 3.38. Vulnerability Details In affected versions, ComfyUI-Manager stored its configuration in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI's web APIs...

CVE-2026-8059 Multiple Vulnerabilities in IBM Datacap

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...