Cisco Identity Services Engine RCE

The vulnerability in the web interface of the Cisco Identity Services Engine ISE management platform is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely and elevate their privileges to the root leve...

PaperCut MF Web Interface Data Read Modify

The vulnerability in the web-based interface for controlling printing control software in PaperCut MF and PaperCut NG is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow an attacker to gain read-only access and modify data...

CVE-2026-92929: Authentication Bypass by Spoofing

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...

CVE-2026-92929

The OpenEye Apex Network Video Recorder (NVR) firmware, specifically version 3.2.9.376 , is vulnerable to an authentication bypass. The software incorrectly trusts the X-Forwarded-For header provided by clients to determine the request source address. This design flaw, present since at least firm...

CVE-2026-92929

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...

CVE-2026-92929

OpenEye Apex Network Video Recorder NVR firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls exposed on the...

CVE-2026-88020

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

EUVD-2026-84871

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-88020

Autonomy Logic OpenPLC Runtime v3 is susceptible to an improper neutralization of input during web page generation vulnerability. This occurs because the web interface fails to encode a query string parameter used for program routing. Successful exploitation could allow an attacker to hijack sess...

CVE-2026-88020 Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-88020 Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

CVE-2026-76714 Authenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE)

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system...

CVE-2026-76714 Authenticated Remote Code Execution with Elevated Privileges Vulnerability in HPE Networking Analytics and Location Engine (ALE)

Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system...

CVE-2026-76714

The HPE Networking Analytics and Location Engine (ALE) contains a vulnerability in its web interface that allows remote authenticated users to perform Remote Code Execution (RCE) . By exploiting this flaw, an attacker can execute arbitrary commands on the underlying host with root privileges , po...

CVE-2026-95697 MISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata

MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwrites organization metadata fields without verifying that the invoking user holds sufficient privileges. A user with a sharing group SG edit...

CVE-2026-88020: Improper Neutralization of Input During Web Page Generation

Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interface attempts to route the program based on a query string parameter with no encoding...

PT-2026-97042

Name of the Vulnerable Software and Affected Versions Autonomy Logic OpenPLC version 3 Description An improper neutralization of input during web page generation occurs in the web interface when routing programs based on a query string parameter that is not encoded. This cross-site scripting XSS...

PT-2026-96152

Name of the Vulnerable Software and Affected Versions ntopng versions prior to 6.7.260717 Description An authentication bypass exists in the web-based network traffic monitoring application where the endpoint "/lua/rest/v2/edit/system/edit blacklist.lua" fails to verify administrator privileges...

FMD Android v0.17.0

FMD Android Find your device via SMS, instant messengers, or a web interface FMD Server. FMD allows you to locate, ring, wipe and issue other commands to your device when it's lost. It aims to be a secure open source alternative to Google's Find My Device. Why? I lost my brand new phone last week...

wingdata

Wingdata — HackTheBox ウォークスルー プラットフォーム: HackTheBox | OS: Linux 攻撃チェーン VHost 列挙で WingFTP サーバーを発見。CVE-2025-47812 のコマンドインジェクションで初期アクセスを取得。root 権限は、細工された tar アーカイブを展開する sudo Python リストアスクリプトを経由して取得 — tar のパストラバーサルにより root として任意のファイルを書き込む。 列挙 root@kitploit: nmap -sC -sV wingdata.htb -Pn 22/tcp open ss...