https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T01:42:02.359552+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-77880 fkie_cve-2026-77880 2026-11-05T01:42:02.360625+00:00

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.

 https://db.gcve.eu/vuln/ghsa-36qx-jxpf-r368 GHSA-36qx-jxpf-r368 2026-11-05T01:42:02.360678+00:00

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.