19879 matches found
PAN-OS Web Interface Code Execution
The vulnerability of the PAN-OS operating system’s web interface for PA-Series, VM-Series, and M-Series virtual devices is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
CVE-2026-1840: Missing Authentication for Critical Function
The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without...
EUVD-2026-38535
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/v1/calendars/events/eventid/update validates that the caller has write access to the calendar the event currently belongs to, but does not validate the destination calendar...
CVE-2026-54019
Open WebUI CVE-2026-54019 describes an ACL bypass in Milvus multitenancy mode. Before version 0.9.6, collection-level ACL checks exist but can be bypassed when an attacker supplies user-controlled, unknown collection names, which Milvus treats as a resource_id and interpolates into an unsafe expr...
Hubbell Aclara Metrum Cellular Web Interface
ADVISORY SUMMARY Successful exploitation of this vulnerability could allow attackers to manipulate critical device settings and repeatedly disrupt operations, potentially causing a loss of communications to the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...
PT-2026-51645
Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1 Description An authenticated user with generic asset edit permissions can delete files attached to assets regardless of ownership or company assignment. This is caused by an Insecure Direct Object Reference IDO...
VulnCheck KEV: CVE-2025-67038
Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges...
UTT 1200GW DoS
The vulnerability of the web-based interface for managing microprogrammed network devices UTT 1200GW is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...
UTT HiPER 1250GW DoS
The vulnerability of the web-based management interface for UTT HiPER 1250GW microprogramming software is related to buffer overflow in the stack when processing the Profile parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...
UTT 1200GW DoS
The vulnerability in the web interface for managing microprogrammed network devices UTT 1200GW is related to the data being written beyond the buffer boundaries in memory when processing the sysAdmUser/sysAdmPass parameter. Exploitation of this vulnerability could allow a malicious actor to cause...
UTT HiPER 1250GW DoS
The vulnerability of the web-based management interface for UTT HiPER 1250GW microprogramming software is related to buffer overflow in the stack when processing the Profile parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...
EUVD-2026-0815
ComfyUI-Manager has an Unprotected Alternate Channel CWE-420...
GHSA-95PQ-HR8P-F5G7 ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)
Impact An Unprotected Alternate Channel CWE-420 vulnerability was discovered in ComfyUI-Manager versions prior to 3.38. Vulnerability Details In affected versions, ComfyUI-Manager stored its configuration in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI's web APIs...
CVE-2026-8059 Multiple Vulnerabilities in IBM Datacap
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...
CVE-2025-33128 IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed
IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...
Incorrect Authorization
Overview org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Incorrect Authorization while configuring verification requests. An attacker can override existing configuration properties by submitting alternative settings...
PT-2026-51428
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description A malicious user with permissions to create files in a repository or wiki page can trigger a denial of service. This occurs when pages containing file listings return an HTTP 500 error, rendering the w...
EUVD-2025-210277
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web pa...
Siemens Ruggedcom Rox Improper Neutralization of Special Elements Used in an OS Command (CVE-2025-40949)
Affected devices do not properly sanitize user-supplied input in the Scheduler functionality of the Web UI, allowing commands to be injected into the task scheduling backend. This could allow an authenticated remote attacker to execute arbitrary commands with root privileges on the underlying...
