17251 matches found
CVE-2026-67437
OliveTin gives access to predefined shell commands from a web interface. From 3000.0.0 until 3000.17.0, the service/internal/auth/otoauth2/restapiauthoauth2.go OAuth2 login handler stores per-login state in the registeredStates map on every /oauth/login request without expiring, deleting, or...
CVE-2026-20316
A vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presen...
EUVD-2026-50404
A vulnerability in the web interface of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems. This vulnerability is due to the presen...
CVE-2026-20316
Cisco Secure Firewall Management Center (FMC) Software is affected by CVE-2026-20316 due to static credentials in the web interface, enabling an unauthenticated, remote attacker with a low-privileged account to log in and access sensitive data. Root cause: hard-coded/static credentials for a low-...
PT-2026-65909
Name of the Vulnerable Software and Affected Versions OliveTin versions 3000.0.0 through 3000.16.0 Description The OAuth2 login handler in service/internal/auth/otoauth2/restapi auth oauth2.go stores per-login state in the registeredStates map for every request made to the /oauth/login endpoint...
CVE-2026-49258
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...
CVE-2026-49258 Nebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)
Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI /ui/ does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h5vg, but the changes were not implemented in the web...
CVE-2026-59764
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...
CVE-2026-14171
An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...
CVE-2026-14171 ads-tec Industrial IT: Post-login open redirect in the web interface
An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...
CVE-2026-14171
CVE-2026-14171 affects ads-tec Industrial IT web UI via an unauthenticated remote attacker abusing improper validation of the post-login redirect. This open redirect could mislead users to a malicious site, with potential impacts to confidentiality and availability as described. Root cause: impro...
EUVD-2026-49725
ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...
CVE-2026-44387
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
PT-2026-65526
IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1 2, and 6.2.2.0 through 6.2.2.0 1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1 2, and 6.2.2.0 through 6.2.2.0 1 is vulnerable to stored cross-site scripting. This vulnerability allows a...
CVE-2026-12989
A lack of authentication in the mobile app APK v5.5.0 for Ghost Robotics' Vision 60 robot allows an unauthenticated attacker connected to the device's internal Wi-Fi network to gain unrestricted access to the web administration interface and the HTTP API. Due to the lack of authorization...
CVE-2026-12495
Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...
CVE-2026-12495 Stack-Based Buffer Overflow in the Mercusys MB115-4G
Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...
EUVD-2026-49144
Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...
EUVD-2026-48744
The web management interface in Tycon Systems TPDIN-Monitor-WEB2 stores and displays system credentials in cleartext on a certain configuration page accessible to authenticated users. Any party with access to the administrative dashboard can immediately read these credentials, which may be used t...