Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,613

Export CSV
CVE-2026-41446

WattBox 800 & 820 Series < 2.10.0.0 RCE via Diagnostic Endpoints

Snap One WattBox 800 and 820 series firmware versions prior to 2.10.0.0 contain undisclosed diagnostic HTTP endpoints that require only the device MAC address and service tag for authentication, both of which are printed in plaintext on the physical device label. Attackers with access to the device label or documentation containing these values can authenticate to the several endpoints and execute arbitrary commands as root on the device.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Snapone
Products
Wattbox 800 Wattbox 820
CVE-2026-7240

Totolink A8000RU CGI cstecgi.cgi setVpnAccountCfg os command injection

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setVpnAccountCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument User leads to os command injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7202

Totolink A8000RU CGI cstecgi.cgi setWiFiWpsStart os command injection

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setWiFiWpsStart of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument wscDisabled leads to os command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7203

Totolink A8000RU CGI cstecgi.cgi setUrlFilterRules os command injection

A vulnerability was found in Totolink A8000RU 7.1cu.643_b20200521. This vulnerability affects the function setUrlFilterRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument enable results in os command injection. The attack can be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7139

Totolink A8000RU CGI cstecgi.cgi setWiFiAclRules os command injection

A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. This issue affects the function setWiFiAclRules of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument mode causes os command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7122

Totolink A8000RU CGI cstecgi.cgi setUPnPCfg os command injection

A vulnerability has been found in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-41386

OpenClaw < 2026.3.22 - Privilege Escalation via Unbound Bootstrap Setup Codes

OpenClaw before 2026.3.22 contains a privilege escalation vulnerability where bootstrap setup codes are not bound to intended device roles and scopes during pairing. Attackers can exploit this during first-use device pairing to escalate privileges beyond their intended role and scope.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Openclaw
Products
Openclaw
CVE-2026-7155

Totolink A8000RU CGI cstecgi.cgi setLoginPasswordCfg os command injection

A security vulnerability has been detected in Totolink A8000RU 7.1cu.643_b20200521. This impacts the function setLoginPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument admpass leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-35503

SenseLive X3050 Use of Hard-coded Credentials

A vulnerability in SenseLive X3050’s web management interface allows authentication logic to be performed entirely on the client side, relying on hardcoded values within browser-executed scripts rather than server-side verification. An attacker with access to the login page could retrieve these exposed parameters and gain unauthorized access to administrative functionality.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Senselive
Products
X3050 X3500 X3500 Firmware
CVE-2026-40620

SenseLive X3050 Missing authentication for critical function

A vulnerability in SenseLive X3050’s embedded management service allows full administrative control to be established without any form of authentication or authorization on the SenseLive config application. The service accepts management connections from any reachable host, enabling unrestricted modification of critical configuration parameters, operational modes, and device state through a vendor-supplied or compatible client.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Senselive
Products
X3050 X3500 X3500 Firmware
CVE-2026-27843

SenseLive X3050 Missing authentication for critical function

A vulnerability exists in SenseLive X3050's web management interface that allows critical configuration parameters to be modified without sufficient authentication or server-side validation. By applying unsupported or disruptive values to recovery mechanisms and network settings, an attacker can induce a persistent lockout state. Because the device lacks a physical reset button, recovery requires specialized technical access via the console to perform a factory reset, resulting in a total denial-of-service for the gateway and its connected RS-485 downstream systems.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Senselive
Products
X3050 X3500 X3500 Firmware
CVE-2026-39462

SenseLive X3050 Insufficiently Protected Credentials

A vulnerability exists in SenseLive X3050’s web management interface in which password updates are not reliably applied due to improper handling of credential changes on the backend. After the device undergoes a factory restore using the SenseLive Config 2.0 tool, the interface may indicate that the password update was successful; however, the system may continue to accept the previous or default credentials, demonstrating that the password-change process is not consistently enforced. Even after a factory reset, attempted password changes may fail to propagate correctly.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Senselive
Products
X3050 X3500 X3500 Firmware
CVE-2026-40630

SenseLive X3050 Authentication bypass using an alternate path or channel

A vulnerability in  SenseLive X3050’s web management interface allows unauthorized access to certain configuration endpoints due to improper access control enforcement. An attacker with network access to the device may be able to bypass the intended authentication mechanism and directly interact with sensitive configuration functions.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Senselive
Products
X3050 X3500 X3500 Firmware
CVE-2026-28205

Initialization of a resource with an insecure default in OpenPLC_V3

OpenPLC_V3 is vulnerable to an Initialization of a Resource with an Insecure Default vulnerability which could allow an attacker to gain access to the system by bypassing authentication via an API.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Openplcproject
Products
Openplc V3 Openplc V3 Firmware
CVE-2026-7152

Totolink A8000RU CGI cstecgi.cgi setTelnetCfg os command injection

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setTelnetCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument telnet_enabled leads to os command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7154

Totolink A8000RU CGI cstecgi.cgi setAdvancedInfoShow os command injection

A weakness has been identified in Totolink A8000RU 7.1cu.643_b20200521. This affects the function setAdvancedInfoShow of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument tty_server can lead to os command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7243

Totolink A8000RU CGI cstecgi.cgi setRadvdCfg os command injection

A vulnerability was identified in Totolink A8000RU 7.1cu.643_b20200521. The affected element is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument maxRtrAdvInterval leads to os command injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7156

Totolink A8000RU CGI cstecgi.cgi CsteSystem os command injection

A vulnerability was detected in Totolink A8000RU 7.1cu.643_b20200521. Affected is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument HTTP results in os command injection. The attack may be launched remotely. The exploit is now public and may be used.

CVSS 4.0 · 9.3 Critical EPSS 1.8% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware
CVE-2026-7244

Totolink A8000RU CGI cstecgi.cgi setWiFiEasyGuestCfg os command injection

A security flaw has been discovered in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setWiFiEasyGuestCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge results in os command injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 9.3 Critical EPSS 2.4% KEV · Not listed
Vendors
Totolink
Products
A8000ru A8000ru Firmware