19975 matches found
PT-2026-23896
Name of the Vulnerable Software and Affected Versions Totolink N300RH versions 6.1.1353 B20190305 Description A flaw exists in the CGI Handler component of Totolink N300RH, specifically within the setWiFiWpsConfig function of the /cgi-bin/cstecgi.cgi file. This allows for operating system command...
[SECURITY] Fedora 44 Update: nextcloud-32.0.6-1.fc44
NextCloud gives you universal access to your files through a web interface or WebDAV. It also provides a platform to easily view & sync your contacts, calendars and bookmarks across all your devices and enables basic editing rig ht on the web. NextCloud is extendable via a simple but powerful API...
Fedora 45 : pcs (2026-acc29a96cf)
The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-acc29a96cf advisory. Automatic update for pcs-0.12.2-1.fc45. Changelog Thu Mar 5 2026 Michal Pospil - 0.12.2-1 - Rebased pcs to the newest major version see CHANGELOG.md...
CVE-2026-30225
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new...
CVE-2026-30223
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" local RSA public key or "authJwtHmacSecret" HMAC secret, the configured audience value authJwtAud is not enforced during toke...
CVE-2026-30233
Technical details for CVE-2026-30233 are not publicly available in the provided connected documents. Monitor for updates.
CVE-2026-30225 OliveTin: RestartAction always runs actions as guest
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new...
CVE-2026-30225
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, an authentication context confusion vulnerability in RestartAction allows a low‑privileged authenticated user to execute actions they are not permitted to run. RestartAction constructs a new...
CVE-2026-30223
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, when JWT authentication is configured using either "authJwtPubKeyPath" local RSA public key or "authJwtHmacSecret" HMAC secret, the configured audience value authJwtAud is not enforced during toke...
CVE-2026-30224
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry default ≈ 1 year...
CVE-2026-30224
OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.11.1, OliveTin does not revoke server-side sessions when a user logs out. Although the browser cookie is cleared, the corresponding session remains valid in server storage until expiry default ≈ 1 year...
CVE-2026-28509
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
CVE-2026-28681 IRRd: web UI host header injection allows password reset poisoning via attacker-controlled email links
Internet Routing Registry daemon version 4 is an IRR database server, processing IRR objects in the RPSL format. From version 4.4.0 to before version 4.4.5 and from version 4.5.0 to before version 4.5.1, an attacker can manipulate the HTTP Host header on a password reset or account creation...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
CVE-2026-28509 LangBot has a Cross Site Scripting(XSS) Vulnerability
LangBot is a global IM bot platform designed for LLMs. Prior to version 4.8.7, LangBot’s web UI renders user-supplied raw HTML using rehypeRaw, which can lead to a cross-site scripting XSS vulnerability. This issue has been patched in version 4.8.7...
Cisco Secure Firewall Management Center Code Execution Root Privileges
The vulnerability of the Web interface for managing Cisco Secure Firewall Management Center software formerly known as Cisco Firepower Management Center is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code wi...
Access Control Web Interface Module Data Compromise
The vulnerability of the Access Control web interface module in IP-telephony systems like FreePBX allows attackers to compromise the confidentiality, integrity, and accessibility of protected information...
Cisco FXOS Software Command Injection (cisco-sa-ucsciv-wGYtC78q)
According to its self-reported version, Cisco FXOS Software is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco FXOS Software could allow an authenticated, local attacker with administrative privileges to perform command injection attacks on an affecte...
Cisco UCS Manager Software Command Injection (cisco-sa-ucsciv-wGYtC78q)
According to its self-reported version, Cisco UCS Manager Software is affected by a vulnerability. - A vulnerability in the web-based management interface of Cisco UCS Manager Software could allow an authenticated, local attacker with administrative privileges to perform command injection attacks...
