CVE-2026-3661

creationtimestamp| type| source ---|---|--- 2026-03-07 17:19:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgidizvhvo2o...

CVE-2026-3661

A flaw has been found in Wavlink WL-NU516U1 240425. This affects the function otanewupgrade of the file /cgi-bin/adm.cgi. This manipulation of the argument model causes command injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor wa...

Rocky Linux Updates applied to SANnav (CVE-2024-3661, CVE-2024-11187, CVE-2024-12797)

Rocky Linux OS updates RSLA-2025:0377, RSLA-2025:1681, RLSA-2025:1330 applied to Brocade SANnav OVA OS CVE-2024-3661 NetworkManager: DHCP routing options can manipulate interface-based VPN traffic CVE-2024-11187 It is possible to construct a zone such that some queries to it will generate respons...

MiracleLinux 9 : NetworkManager-1.48.10-5.el9_5.ML.1 (AXSA:2025-9560:03)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2025-9560:03 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its...

CLSA-2025-1764322970 NetworkManager: Fix of CVE-2024-3661

CVE-2024-3661: fix TunnelVision vulnerability by preventing DHCP option 121 route manipulation that could bypass VPN encryption and leak traffic...

Moderate: Red Hat Security Advisory: NetworkManager security update

An update for NetworkManager is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availab...

RHEL 9 : NetworkManager (RHSA-2025:16411)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:16411 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

TencentOS Server 4: NetworkManager (TSSA-2025:0067)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0067 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

TencentOS Server 3: Bug fix of NetworkManager (Moderate) (TSSA-2025:0044)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0044 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

CVE-2021-3661

creationtimestamp| type| source ---|---|--- 2025-04-29 05:11:19+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/13781...

Security Bulletin: IBM Technical Suppport Appliance - possible security flaw in DHCP processing that may leak and disrupt network traffic

Summary A flaw in the network manager may cause network traffic to be read and possibly modified when it was expected that the network traffic was protected by a VPN. Vulnerability Details CVEID:CVE-2024-3661 DESCRIPTION: DHCP can add routes to a client’s routing table via the classless static...

CVE-2025-3661

creationtimestamp| type| source ---|---|--- 2025-04-19 10:02:15+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/12579 2025-04-19 12:39:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ln65qdu4sc2a 2025-04-19 13:28:49+00:00| seen| https://t.me/cvedetector/23380...

CVE-2025-3661 SB Chart block <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter

The SB Chart block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...

WordPress SB Chart block plugin <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via className Parameter vulnerability discovered by Peter Thaleikis in WordPress Plugin SB Chart block versions = 1.2.6...

Linux Distros Unpatched Vulnerability : CVE-2024-3661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - DHCP can add routes to a client's routing table via the classless static route option 121. VPN-based security solutions that rely on routes to redirect traffic...

CVE-2019-3661

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' in McAfee Advanced Threat Defense ATD prior to 4.8 allows remote authenticated attacker to execute database commands via carefully constructed time based payloads...

Rocky Linux 9 : booth (RLSA-2024:3661)

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:3661 advisory. booth: specially crafted hash can lead to invalid HMAC being accepted by Booth server CVE-2024-3049 Tenable has extracted the preceding description block directl...

Fortinet FortiClient TunnelVision - CVE-2024-3661 (FG-IR-24-170) (macOS)

The version of FortiClient installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-24-170 advisory. - DHCP can add routes to a client's routing table via the classless static route option 121. VPN-based security solutions...

F5 Networks BIG-IP : VPN TunnelVision vulnerability (K000139553)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000139553 advisory. By design, the DHCP protocol does not authenticate messages, including for example the classless static route option...

New TunnelVision Attack Allows Hijacking of VPN Traffic via DHCP Manipulation

Researchers have detailed a Virtual Private Network VPN bypass technique dubbed TunnelVision that allows threat actors to snoop on victim's network traffic by just being on the same local network. The "decloaking" method has been assigned the CVE identifier CVE-2024-3661 CVSS score: 7.6. It impac...