CVE-2026-20350 Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface...

EUVD-2026-81116

A vulnerability in Cisco Secure FMC Software could allow an authenticated, remote attacker to execute arbitrary commands at the root privilege level. This vulnerability is due to unsecured deserialization of web-management user-controlled data. An attacker could exploit this vulnerability by...

org.apache.nifi:nifi-toolkit-api (>=2.9.0, <=2.11.0) potentially affected by CVE-2026-81866 via org.apache.nifi:nifi-web-api (>=2.9.0, <=2.11.0)

org.apache.nifi:nifi-web-api MAVEN version =2.9.0, =2.9.0, =2.11.0 Source cves: CVE-2026-81866 Source advisory: MEND:CVE-2026-81866...

org.apache.nifi:nifi-framework-nar (>=1.5.0, <=1.12.1), org.apache.nifi:nifi-jetty (>=1.5.0, <=1.15.3) +3 more potentially affected by CVE-2026-82561 via org.apache.nifi:nifi-web-api (>=1.5.0, <=2.11.0)

org.apache.nifi:nifi-web-api MAVEN version =1.5.0, =1.5.0, =1.5.0, =1.13.0, =1.11.0, =1.10.0, =2.11.0 Source cves: CVE-2026-82561 Source advisory: MEND:CVE-2026-82561...

org.apache.nifi:nifi-toolkit-api (2.11.0) potentially affected by CVE-2026-86089 via org.apache.nifi:nifi-web-api (2.11.0)

org.apache.nifi:nifi-web-api MAVEN version 2.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi:nifi-web-api and may be impacted: - org.apache.nifi:nifi-toolkit-api 2.11.0 Source cves: CVE-2026-86089 Source advisory: MEND:CVE-2026-860...

org.apache.nifi.registry:nifi-registry-web-api (2.0.0-m1) potentially affected by CVE-2026-87976 via org.apache.nifi.registry:nifi-registry-framework (2.0.0-m1)

org.apache.nifi.registry:nifi-registry-framework MAVEN version 2.0.0-m1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.nifi.registry:nifi-registry-framework and may be impacted: - org.apache.nifi.registry:nifi-registry-web-api 2.0.0-m1 Sour...

CVE-2026-92005

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Web Codecs component...

CVE-2026-64753

A flaw was found in WebKitGTK. Processing malicious web content can disclose sensitive user information due to a permission issue. Mitigation Do not process or load untrusted web content with WebKitGTK. In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-serve...

EUVD-2026-80886

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative...

CVE-2026-20307 Cisco Identity Services Engine Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative...

CVE-2026-20307 Cisco Identity Services Engine Remote Code Execution Vulnerability

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. To exploit this vulnerability, the attacker must have at least low-privileged administrative...

Cisco ThousandEyes Virtual Appliance Authenticated Web Interface Command Injection Vulnerability

A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker to inject arbitrary operating system commands. This vulnerability is due to improper validation of user-supplied input to the web-based management interface...

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web-based management interface...

SUSE CVE-2026-91719

Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-91732

Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...

owasp-web-security-notes

🛡️ OWASP Web Security Notes A hand-written, exploitation-dep...

tomcat: Apache Tomcat: Race condition allows HTTP/2 request manipulation

A flaw was found in Apache Tomcat. This vulnerability, caused by a race condition during concurrent execution, allows an attacker to inject unauthorized data, known as trailer fields, into another user's HTTP/2 request. This could lead to the manipulation of web traffic or unintended information...

Security Bulletin: The IBM Platform RTM is affected by an SQL injection vulnerability (CVE-2026-17619)

Summary The IBM Platform RTM takes an input in web interface directly for SQL Query, unvalidated value might allow bad actor to insert malicious code into the SQL Query phase. Vulnerability Details CVEID:CVE-2026-17619 DESCRIPTION: IBM Platform RTM is vulnerable to SQL injection. A remote attacke...

CVE-2026-73176

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...

CVE-2026-73165

Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in the web management interface of Advantech EKI-1242IEIMS in firmware version V1.06.01 that allows a remote authenticated attacker to execute arbitrary...