CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

CVE-2026-108264

Wizarr, a management system for media servers like Jellyfin and Plex, is vulnerable to Server-Side Template Injection (SSTI) prior to version 2026.9.1 . The issue exists because wizard step Markdown—provided via the editor or imported bundles—is evaluated in a non-sandboxed Jinja2 environment wit...

PT-2026-109318

Name of the Vulnerable Software and Affected Versions Wizarr versions prior to 2026.9.1 Description Markdown content provided through the editor or imported bundles is evaluated in a non-sandboxed Jinja2 environment with application globals exposed. This allows an authenticated user with...

ASUS DSL-AC88U Auth Bypass (CVE-2024-3080)

Exploits CVE-2024-3080 in ASUS DSL-AC88U: /js/..%2f%2f or /images/..%2f%2e traversal bypasses authentication and exposes admin wizard pages. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS DSL-AC88U path traversal auth bypass CVE-2024-3080.""" from kittysploit import from...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: clk: clocking-wizard: Fixed an error in clkwzrdregisterdivider. A match was detected for a potential error of dereferencing the pointer in clkwzrdregisterdivider. If devmclkHWRegister fails, it sets “hw” to an error pointer, and...

Setup Wizard Privilege Escalation

The vulnerability of the Setup Wizard component in Android operating systems is related to a breach of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to enhance their privileges...

Setup Wizard Privilege Escalation

The vulnerability of the Setup Wizard component in Android operating systems relates to the possibility of bypassing access control mechanisms. Exploiting this vulnerability allows a remote attacker to enhance their privileges...

PT-2026-103773

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount wizard/discount config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code t...

PT-2026-105846

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

CVE-2026-100745

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

EUVD-2026-87833

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

CVE-2026-100745 Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

CVE-2026-100745 Edimax BR-6428nC Wireless Wizard formWizSurvey stack-based overflow

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

CVE-2026-100745

A stack-based buffer overflow vulnerability exists in the Edimax BR-6428nC (version 1.16) within the Wireless Wizard Handler component. The flaw is located in an unknown function of the /goform/formWizSurvey file, where manipulating the interface1/interface2 argument can trigger the overflow. Rem...

CVE-2026-100745: Stack-based Buffer Overflow

A vulnerability has been found in Edimax BR-6428nC 1.16. The impacted element is an unknown function of the file /goform/formWizSurvey of the component Wireless Wizard Handler. The manipulation of the argument interface1/interface2 leads to stack-based buffer overflow. Remote exploitation of the...

PT-2026-99488

Name of the Vulnerable Software and Affected Versions Edimax BR-6428nC version 1.16 Description A stack-based buffer overflow exists in the Wireless Wizard Handler component within the /goform/formWizSurvey endpoint. This issue occurs when the interface1 or interface2 arguments are manipulated,...

CVE-2026-92805

CVE-2026-92805 UVdesk unauth wizard super-admin POC UVdesk Community Skeleton through 1.1.8 — installation wizard XHR ConfigureHelpdesk has no authentication and no install-state check. An unauthenticated caller can rewrite DATABASEURL and create a ROLESUPERADMIN. There is no public patched tag...

Cross-site Scripting (XSS)

Overview mcp-atlassian is a The Model Context Protocol MCP Atlassian integration is an open-source implementation that bridges Atlassian products Jira and Confluence with AI language models following Anthropic's MCP specification. This project enables secure, contextual AI interactions with...

com.airbus-cyber-security.graylog:graylog-plugin-alert-wizard (7.0.0), com.airbus-cyber-security.graylog:graylog-plugin-correlation-count (7.0.0) +3 more potentially affected by CVE-2026-69190 via org.graylog2:graylog2-server (>=7.0.0, <=7.0.8)

org.graylog2:graylog2-server MAVEN version =7.0.0, =7.0.0, =7.0.0, =7.0.8 Source cves: CVE-2026-69190 Source advisory: SNYK:JAVA-ORGGRAYLOG2-20079479...