CVE WATCH / VULNERABILITY DETAIL
CVE-2026-77879
HIGHCVSS 7.7NVD feed
Published 2 November 2026 · tracked since 3 November 2026
Description
Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-119736 HIGH 8.2
- CVE-2026-120057 HIGH 7.5
- CVE-2026-120058 HIGH 7.5
- CVE-2026-105603
- CVE-2026-105604
- CVE-2026-119301 HIGH 7.9
- CVE-2026-105769 CRITICAL 9.3
- CVE-2026-99242
- CVE-2026-99236 HIGH 7.8
- CVE-2026-99237 HIGH 7.8