Export limit exceeded: 232359 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 232359 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 232359 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (232359 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-107365 | 1 Grafana | 3 Google Cloud Monitoring Datasource, Grafana, Grafana Enterprise | 2026-11-13 | 5.3 Medium |
| A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7. | ||||
| CVE-2026-106475 | 1 Grafana | 3 Elasticsearch Datasource, Grafana, Grafana Enterprise | 2026-11-13 | 7.1 High |
| The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data source's own credentials, without restricting them to the operations the plugin needs. A user who can query the data source can alter index mappings or reach other indices on the cluster. [Improper authorization / path validation] | ||||
| CVE-2026-127063 | 1 Connectwise | 1 Datacomm Rmm+ | 2026-11-13 | N/A |
| The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by default. The value can be changed by an administrator; however, environments retaining the default value may allow unauthorized access to extension API functionality, including the ability to send commands to managed agents. This issue is specific to the third-party extension and does not affect the ScreenConnect server or client. Scope: This issue affects the third-party RMM+ extension for ConnectWise ScreenConnect. Deployments without the extension are not affected. ScreenConnect server or client software are not impacted. | ||||
| CVE-2026-0460 | 1 Amd | 1 Bootgen | 2026-11-13 | N/A |
| Improper authentication in Bootgen could result in the use of a fixed salt value for RSA padding instead of a randomly generated salt, potentially impacting data integrity. | ||||
| CVE-2026-124002 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 9.8 Critical |
| XWEB EVO versions 5.2.3 through before 5.7.0 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by injecting shell metacharacters into the username field of login.lua, cleanout.lua, or api.lua before the password check occurs. Attackers can exploit this flaw combined with the setuid-root wlua interpreter to execute commands with root privileges, achieving full system compromise. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124003 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 7.8 High |
| XWEB EVO before 5.6.2 contains a command injection vulnerability where the setuid-root Lua CGI interpreter wlua executes system("/usr/bin/lua "+argv) on unsanitized input. Attackers can craft malicious input reached through a .lua CGI endpoint to inject arbitrary commands into the concatenated argv string, achieving command execution with root privileges. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124004 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 9.8 Critical |
| XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124005 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 8.1 High |
| XWEB EVO 4.3.0 through 5.8.8 contains a weak password generation vulnerability that allows remote attackers to derive the Administrator code-of-the-day password using only the device MAC address and date, with no server secret involved. Attackers can analyze the firmware binary xwpasswd, which itself functions as the password generator, to compute valid Administrator credentials offline and authenticate to the device without authorization. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124006 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 8.1 High |
| XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124007 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 8.1 High |
| XWEB EVO before 5.6.2 contains a pre-authentication OS command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands by injecting shell metacharacters into the password field. Attackers can exploit the unescaped interpolation of the password value into the hashpass invocation within login.lua, cleanout.lua, and api.lua to achieve root-level command execution via the setuid wlua interpreter. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124008 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 7.2 High |
| XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability in the devices.lua template handling, which allows authenticated attackers to execute arbitrary commands by injecting unescaped template source into unzip and related shell commands. Attackers can exploit this flaw through the wlua interpreter to execute arbitrary commands with root privileges on the affected device. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124009 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 7.2 High |
| XWEB EVO 5.2.3 through 5.8.8 contains an authenticated OS command injection vulnerability that allows authenticated attackers to execute arbitrary commands as root by injecting shell metacharacters into the output device path parameter processed by backup.lua. Attackers can exploit the unescaped concatenation into mount, unzip, and related shell commands run via the wlua interpreter, including through the setuid xwbackup.cgi and xwrestore.cgi interfaces, to achieve full system compromise. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124010 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 9.8 Critical |
| XWEB EVO before 5.6.2 contains a command injection vulnerability that allows unauthenticated remote attackers to execute arbitrary commands as root by exploiting the setuid-root CGI xwconsole.cgi. Attackers can supply malicious input through the sh parameter, which is passed unsanitized to popen(), to achieve full system compromise. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124011 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 5.3 Medium |
| XWEB EVO 5.6.2 through 5.8.8 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain the device's eth0 MAC address and system clock by accessing sysinfo.lua, which also feeds the pre-login page. Attackers can use the disclosed MAC address and system clock values to offline derive the MAC-based daily password, enabling unauthorized authentication to the device. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124012 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 8.1 High |
| XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124013 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 8.8 High |
| XWEB EVO 5.6.2 through 5.8.8 contains an authenticated OS command injection vulnerability in the api.lua import_preconfiguration and restore actions, where server_url and related server credential fields are concatenated unescaped into a root curl command executed via io.popen. Attackers can inject malicious shell commands through these unfiltered parameters to achieve arbitrary command execution with root privileges on the underlying system. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124014 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 9.1 Critical |
| XWEB EVO 4.3.0 through 5.8.8 contains an unauthenticated arbitrary file write vulnerability that allows remote attackers to modify the system configuration file /etc/xwebconfig.json by sending a crafted POST request to config.lua with action=set, which performs no session validation and writes the raw, unvalidated request body. Attackers can tamper with configuration values such as model and plugin fields or trigger a SYSTEM_NOT_CONFIGURED state via the unauthenticated action=get and action=set operations, resulting in configuration tampering and denial of service. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-124015 | 1 Copeland | 1 Xweb Evo | 2026-11-13 | 5.9 Medium |
| XWEB EVO 5.6.2 through 5.8.8 contains an authentication bypass vulnerability that allows unauthenticated attackers to set the password of any account flagged must-reset-at-next-login by exploiting missing session validation in the users.lua update_password action. Attackers can reset the password of newly onboarded operator accounts, clearing the password_expiration flag and gaining an immediately usable authenticated foothold on the system. This product line reached it's end of service date in March 2026. | ||||
| CVE-2026-125784 | 2 Magnigenie, Wordpress-extensions | 2 Restropress, Restropress | 2026-11-13 | 8.8 High |
| Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request Forgery.This issue affects RestroPress: from n/a through 3.4.11. | ||||
| CVE-2026-126659 | 1 Blueprintue | 1 Blueprintue-self-hosted-edition | 2026-11-13 | 7.5 High |
| BlueprintUE Self-Hosted Edition 1.0.0 before 4.3.5 contains a resource exhaustion vulnerability that allows unauthenticated attackers to fill server storage by repeatedly creating anonymous blueprints. Attackers can send large requests to HomeController::doProcessCreateBlueprint() with a 'never' expiration, bypassing purges to fill the disk and deny service. | ||||