CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.23)
COMFAST CF-XR11 version V2.7.2 has a command injection vulnerability detected at function sub_415588. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameters interface and display_name.
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function in the bin/webmgnt file.
The Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to set up CIM connection.
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking an HTTP Strict-Transport-Security policy.
Broadcom RAID Controller is vulnerable to privilege escalation to root due to the creation of insecure folders by the Web GUI.
Broadcom RAID Controller is vulnerable to privilege escalation by taking advantage of session prints in the log file.
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not provide X-Content-Type-Options headers.
The Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation.
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard cookies with the Secure attribute.
The Broadcom RAID Controller web interface is vulnerable due to an insecure default HTTP configuration that does not safeguard the SESSIONID cookie with the SameSite attribute.
The Broadcom RAID Controller web interface is vulnerable due to the use of Libcurl, which has known vulnerabilities.
The Broadcom RAID Controller web interface is vulnerable due to insecure defaults lacking HTTP Content-Security-Policy headers.
The Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup.
COMFAST CF-XR11 version V2.7.2 has a command injection vulnerability detected at function sub_4143F0. Attackers can send POST request messages to /usr/bin/webmgnt and inject commands into parameter timestr.
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 function in the bin/webmgnt file.
Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the destination parameter of the sub_431F64 function in the bin/webmgnt file.
An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via the username parameter of the set_sys_adm function in adm.cgi.
Versions of llama_index up to 0.7.13 contain a vulnerability that allows a remote attacker to execute arbitrary code via the `exec` parameter in the PandasQueryEngine function.
An issue in pandas-ai versions 0.9.1 and earlier allows a remote attacker to execute arbitrary code via the _is_jailbreak function.
Versions of langchain langchain-ai up to 0.0.232 contain a vulnerability that allows a remote attacker to execute arbitrary code via a crafted script in the PythonAstREPLTool._run component.