CVE ID :CVE-2026-104080 Published : Nov. 2, 2026, 4:17 p.m. | 46 minutes ago Description :Control Web Panel (CWP) before webpanel_version 1.30 contains an OS command injection vulnerability in the loopback API /valid_token/ route that allows unauthenticated attackers to execute arbitrary...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-104080 - Control Web Panel (CWP) < 1.30 OS Command Injection via valid_token

VERWANDTEARTIKEL

CVE-2026-120955 - MongoDB C Driver Modern GridFS mongoc_gridfs_bucket_download_to_stream() Aborts Application on Malformed GridFS Metadata

CVE-2026-120678 - mongo-c-driver leaks the decompressed reply buffer when an OP_COMPRESSED reply fails to parse (denial of service)

CVE-2026-63494 - AVideo OS Command Injection Vulnerability

CVE-2026-44267 - Elo: Sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access in Elo JavaScript emitter

CVE-2026-63492 - AVideo OS Command Injection

CVE-2026-44266 - Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels