PT-2026-80490

A flaw was found in GLib. The D-Bus client-side implementation of the DBUS COOKIE SHA1 SASL authentication mechanism does not validate the cookie context parameter received from the server. A malicious D-Bus server can supply a cookie context containing path traversal sequences, causing the clien...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32365)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability stems from the /boafrm/formDebugDiagnostics interface...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32362)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability stems from the /boafrm/formIMEISetup interface not...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32363)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability, which stems from the /boafrm/formPinManager interface not filtering the...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32359)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability, which stems from the app.cgi interface not filtering the command separato...

D-Link DWR-M961 buffer overflow vulnerability

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a buffer overflow vulnerability. This vulnerability stems from the app.cgi interface not properly restrictin...

UBUNTU-CVE-2026-68313

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. As the loop never terminates, genlmutex is never released, and other tasks...

CVE-2026-68313: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tipc: fix infinite loop in tipcnlcompatdumpit cmd-dumpit callback can return a negative errno, causing an infinite loop due to the whilelen condition. As the loop never terminates, genlmutex is never released, and other tasks...

PT-2026-80476

xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used...

CVE-2026-71958

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71954

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in...

CVE-2026-71955

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resultin...

CVE-2026-71948

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formDebugDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71949

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formUSSDSetup interface. A remote attacker can inject arbitrary malicious commands into the ussdValue and selectMenuValue fields, resulting in...

CVE-2026-71951

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

CVE-2026-71950

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formSmsManage interface. A remote attacker can inject arbitrary malicious commands into the actionvalue field, resulting in command execution...

CVE-2026-71945

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeFibocom interface. A remote attacker can inject arbitrary malicious commands into the fotaurl field, resulting in command...

CVE-2026-71947

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formTracerouteDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host and ipVer fields, resulting in...

EUVD-2026-54810

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a...

CVE-2026-71958

The CVE-2026-71958 entry concerns D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044). The vulnerability is a buffer overflow in the quicksetup.cgi interface. An unauthenticated remote attacker can supply oversized inputs to the test4, ssid2, and username fields to cause...