PYSEC-2026-3667 Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

Summary Glances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead ...

MINI-3667-GV66-GMC2

Bulletin has no description...

MINI-8649-3667-QH9Q

Bulletin has no description...

CVE-2026-3667

creationtimestamp| type| source ---|---|--- 2026-03-07 15:15:56+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3667 2026-03-07 20:03:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mgimpfqg2o2y...

Linux Distros Unpatched Vulnerability : CVE-2022-3667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability, which was classified as critical, was found in Axiomatic Bento4. This affects the function AP4MemoryByteStream::WritePartial of the file...

CVE-2020-3667

u'Buffer Overflow in mic calculation for WPA due to copying data into buffer without validating the length of buffer' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

CVE-2019-3667

DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker...

CVE-2025-3667

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3667

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3667

creationtimestamp| type| source ---|---|--- 2025-04-16 04:56:01+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/11989 2025-04-16 06:48:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lmvyq7igod24 2025-04-16 10:10:33+00:00| seen|...

CVE-2025-3667 TOTOLINK A3700R cstecgi.cgi setUPnPCfg access control

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3667 TOTOLINK A3700R cstecgi.cgi setUPnPCfg access control

A vulnerability was found in TOTOLINK A3700R 9.1.2u.5822B20200513. It has been classified as critical. This affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-3667

CVE-2025-3667 concerns the TOTOLINK A3700R router (version 9.1.2u.5822_B20200513). The vulnerability lies in the function setUPnPCfg within the file /cgi-bin/cstecgi.cgi , causing improper access controls. The issue can be triggered remotely, and public exploitation has been disclosed. Multiple c...

Linux Distros Unpatched Vulnerability : CVE-2021-3667

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoolLookupByTargetPath function where a lock...

CVE-2021-3667

creationtimestamp| type| source ---|---|--- 2025-02-14 09:46:58+00:00| seen| Telegram/kpFylxtyN4TDKyoZC3QOG0bAYj82lXuGNIn1E91z1-UYUaeV...

Rocky Linux 8 : cockpit (RLSA-2024:3667)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:3667 advisory. cockpit: command injection when deleting a sosreport with a crafted name CVE-2024-2947 Tenable has extracted the preceding description block directly from the...

CVE-2024-3667

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3667 Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-3667

The Brizy – Page Builder WordPress plugin contains a Stored XSS in the Brizy widgets’ Link To field (CVE-2024-3667). Affected versions are all up to and including 2.4.43. Exploitation requires authentication at contributor level or higher, enabling an attacker to inject scripts that run on pages ...

CVE-2024-3667 Brizy – Page Builder <= 2.4.43 - Authenticated (Contributor+) Store Cross-Site Scripting via Widget Link To URL

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Link To' field of multiple widgets in all versions up to, and including, 2.4.43 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...