CVE-2026-16876

NEC UNIVERGE IX-R/IX-V series routers are affected by an authentication bypass in the WebGUI component, classified as Missing Authentication for Critical Function (CWE-306) . A remote unauthenticated attacker can send a specially crafted message to the WebGUI over the internet to execute arbitrar...

CVE-2026-16876: Missing Authentication for Critical Function

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet...

PT-2026-86590

An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arbitrary CLI commands by tampering with WebGUI messages and sending them to the device via internet...

PT-2026-86255

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP IBCF-NATUP-01/NMSCI-WebGui/backup restore.jsp and NP IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter. A malicious user leveraging this vulnerability could inject arbitrary JavaScript. The malicious payload will th...

UNIVERGE IX-R/IX-V series routers vulnerable to missing authentication for critical function

Overview UNIVERGE IX-R/IX-V series routers provided by NEC Corporation contain the following vulnerability. Missing authentication for critical function CWE-306 - CVE-2026-16876 Kojiro Enokida of SOPHOS reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information...

CVE-2024-39024

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution...

CVE-2024-39024

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution...

CVE-2024-39024

In Packetfence 13.2.0 , an authenticated remote code execution (RCE) vulnerability exists within the WebGui interface setting. The root cause is located in Interface.pm at line 64 within the create function, where the $vlan_id variable—derived from user input—is only validated on the client side....

CVE-2024-39024

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution...

CVE-2024-39024: Improper Neutralization of Input During Web Page Generation

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution...

Security Bulletin: Multiple Vulnerabilities in IBM Tivoli Netcool/OMNIbus WebGUI (CVE-2026-59879, CVE-2026-59880)

Summary IBM Tivoli Netcool/OMNIbus WebGUI includes the Immutable.js library for persistent immutable data structures used in the client-side UI. Vulnerabilities have been identified in this library that could affect the product. Vulnerability Details CVEID:CVE-2026-59879 DESCRIPTION: Immutable.js...

CVE-2026-7839: Use of Hard-coded Credentials

UltraVNC repeater through 1.8.2.2 initializes the HTTP administration server with a hardcoded default password. In repeater/webgui/settings.c:197, when settings2.txt is absent on first run the repeater writes the literal string "adminadmi2" as the admin password via strcpyssavedpassword, 64,...

Security Bulletin: Multiple security vulnerabilities has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI - April 2026 Java CPU

Summary Websphere Application Server WAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about security vulnerabilities affecting WAS has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

Security Bulletin: Multiple security vulnerabilities has been identified in IBM WebSphere Application Server shipped with Tivoli Netcool/OMNIbus WebGUI - January 2026 CPU and CVE-2026-1188

Summary Websphere Application Server WAS is shipped as a component of Tivoli Netcool/OMNIbus WebGUI. Information about security vulnerabilities affecting WAS has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

RaspAP raspap-webgui contains an OS Command Injection vulnerability

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS Command Injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

OS command injection in raspap-webgui

Overview RaspAP raspap-webgui contains the following vulnerability. OS command injection CWE-78 - CVE-2026-24788 Taihei Kusayanagi of NTT Security Japan KK reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...

CVE-2026-24788

RaspAP raspap-webgui versions prior to 3.3.6 contain an OS command injection vulnerability. If exploited, an arbitrary OS command may be executed by a user who can log in to the product...