CVE-2026-3677

A vulnerability was found in Tenda FH451 1.0.0.9. This impacts the function fromSetCfm of the file /goform/setcfm. The manipulation of the argument funcname/funcpara1 results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be use...

CVE-2026-3677

A vulnerability was found in Tenda FH451 1.0.0.9. This impacts the function fromSetCfm of the file /goform/setcfm. The manipulation of the argument funcname/funcpara1 results in stack-based buffer overflow. The attack may be performed from remote. The exploit has been made public and could be use...

CVE-2026-3677

creationtimestamp| type| source ---|---|--- 2026-03-07 21:15:50+00:00| seen| https://www.incibe.es/incibe-cert/alerta-temprana/vulnerabilidades/cve-2026-3677 2026-03-13 02:38:10+00:00| seen| https://bsky.app/profile/secqube.com/post/3mgvv3c7wyh2y...

GHSA-3677-XXCR-WJQV vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, confluent-common-docker, apache-pulsar...

SUSE: Security Advisory (SUSE-SU-2025:3677-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-3677

The Ultimate 410 Gone Status Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 410 entries in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

Alibaba Cloud Linux 3 : 0136: postgresql:13 (ALINUX3-SA-2022:0136)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0136 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2021-23214: It was found that a...

CVE-2025-3677

A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function splitfiles/applydeltalowcpumem of the file fastchat/model/applydelta.py. The manipulation leads to deserialization. An attack has to be approached locally...

CVE-2025-3677 lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization

A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function splitfiles/applydeltalowcpumem of the file fastchat/model/applydelta.py. The manipulation leads to deserialization. An attack has to be approached locally...

CVE-2025-3677 lm-sys fastchat apply_delta.py apply_delta_low_cpu_mem deserialization

A vulnerability classified as critical was found in lm-sys fastchat up to 0.2.36. This vulnerability affects the function splitfiles/applydeltalowcpumem of the file fastchat/model/applydelta.py. The manipulation leads to deserialization. An attack has to be approached locally...

CVE-2025-3677

CVE-2025-3677 affects lm-sys fastchat up to 0.2.36. A vulnerability in fastchat/model/apply_delta.py -> split_files/apply_delta_low_cpu_mem allows deserialization when manipulated locally. The connected docs specify a local-access exploitation vector; no exploit details are provided and no rem...

K000149918: PostgresQL vulnerability CVE-2021-3677

Security Advisory Description A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database user can complete this attack at will. The attack does not require the ability to create objects. If server...

CVE-2024-3677

The Ultimate 410 Gone Status Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 410 entries in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-leve...

WordPress Ultimate 410 Gone Status Code Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)

Software Ultimate 410 Gone Status Code Type Plugin Vulnerable versions = 1.1.4 Fixed in 1.1.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3677 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 8e6494963676 Credits Krzysztof...

Rocky Linux 8 : postgresql:12 (RLSA-2021:5235)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:5235 advisory. - When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker ca...

Puppet Enterprise < 2019.8.8 / 2021.x < 2021.3 PostgreSQL Vulnerability

For more information about this vulnerability, refer to the security announcements for CVE-2021-3677 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text in this plugi...

CVE-2023-3677

creationtimestamp| type| source ---|---|--- 2023-08-31 12:12:57+00:00| seen| https://t.me/cibsecurity/69519...

CVE-2023-3677 WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Export

The WooCommerce PDF Invoice Builder plugin for WordPress is vulnerable to SQL Injection via the pageId parameter in versions up to, and including, 1.2.89 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVE-2023-3677

CVE-2023-3677 affects the WooCommerce PDF Invoice Builder plugin for WordPress (versions

WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.89 is vulnerable to SQL Injection

Software WooCommerce PDF Invoice Builder Type Plugin Vulnerable versions = 1.2.89 Fixed in 1.2.90 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-3677 Patch priority High CVSS severity High 8.5 Developer Edgar Rojas PSID 2cec7ed323a9 Credits Marco Wotschka Required privilege...