PT-2026-68428

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the hid-lenovo-go driver where the hid go cfg remove function fails to drain delayed work. The hid go cfg probe function initializes drvdata.go cfg setup and schedules...

EUVD-2026-53358

OpenBK7231T's /cfgwifiset endpoint src/httpserver/httpfns.c accepts configuration changes via a plain GET request with no CSRF token. If the webadminpasswordenabled parameter is absent from the request, an else-branch silently clears the device's web admin password to an empty string. A one-click...

PT-2026-68146

Name of the Vulnerable Software and Affected Versions OpenBK7231T affected versions not specified Description The '/cfg wifi set' endpoint in 'src/httpserver/http fns.c' allows configuration changes through a GET request without requiring a Cross-Site Request Forgery CSRF token. CSRF is a type of...

CVE-2026-71264: Missing Authorization

WLED's GET /json/cfg endpoint registered in wled00/wledserver.cpp calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration network, hardware, LED setup to any unauthenticated client on the network...

PT-2026-68137

Name of the Vulnerable Software and Affected Versions WLED affected versions not specified Description The software contains two security flaws. First, the 'GET /json/cfg' endpoint calls the serveJson function without verifying the settings-PIN, allowing any unauthenticated client on the network ...

Monstra CMS 3.0.4 - HTTP Header Injection Detection

Monstra CMS 3.0.4 is susceptible to HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter. An attacker can potentially supply invalid input and cause the server to allow redirects to attacker-controlled domains, perform cache poisoning, and/or allow improper access to...

Avigilon Login Panel - Detect

Avigilon login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Avigilon login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Avigilon Login Panel - Detect', 'description':...

WordPress GraceMedia Media Player 1.0 - Local File Inclusion Detection

WordPress GraceMedia Media Player plugin 1.0 is susceptible to local file inclusion via the cfg parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress GraceMedia Media Player plugin 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

autotrain-advanced (>=0.6.15, <=0.7.63), cfg-analysis-tool-py (0.1.0) +35 more potentially affected by CVE-2026-66007 via datasets (2.14.7)

datasets PYPI version 2.14.7 is affected by a known vulnerability. The following packages have a transitive dependency on datasets and may be impacted: - autotrain-advanced =0.6.15, =0.1.3, =0.1.3, =0.1.1, =0.0.1rc7, =0.1.0, =2.1.4, =0.2.0, =2024.3.4, =0.0.66, =2.3.1, =0.1.0.dev0, =0.1.0.1 and mo...

CVE-2024-51314

The Tenda TX9 router running firmware version V22.03.02.20 is vulnerable to a stack overflow vulnerability. The flaw exists within the sub_424CE0 function located in the /goform/setMacFilterCfg file. Exploitation of this vulnerability could lead to a critical impact on confidentiality, integrity,...

PT-2026-61724

Name of the Vulnerable Software and Affected Versions Tenda TX9 version V22.03.02.20 Description A stack overflow occurs in the sub 42EEE0 function within the /goform/SetStaticRouteCfg file. A stack overflow is a condition where a program writes more data to a stack-allocated buffer than it can...

CVE-2026-63908 Input: atmel_mxt_ts - fix boundary check in mxt_prepare_cfg_mem

In the Linux kernel, the following vulnerability has been resolved: Input: atmelmxtts - fix boundary check in mxtpreparecfgmem When a configuration file provides an object size that is larger than the driver's known mxtobjsizeobject, the driver intends to discard the extra bytes. The loop iterate...

CVE-2026-41514

OP-TEE is a Trusted Execution Environment TEE designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technology. Starting in version 4.5.0 and prior to version 4.11.0, the RSA-OAEP decryption implementation in the Hisilicon HPRE crypto driver uses...

TOTOLINK A3300R Router setIptvCfg() Command Execution

The vulnerability of the setIptvCfg function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK A3300R router’s microprogramming system is related to the failure to take measures to neutralize special elements during the processing of the vlanPriLan3 parameter. Exploiting this vulnerability allow...

UBUNTU-CVE-2026-53278

In the Linux kernel, the following vulnerability has been resolved: armmpam: Check whether the config array is allocated before destroying it destroycomponentcfg is called to free the configuration array. It uses the embedded 'garbage' structure, which means the array has to be allocated. If...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix VF illegal register access The register WXCFGPORTST is a PF restricted register. When initializing a VF, attempting to read this register triggers an illegal register access, which can cause the system to hang. Wh...

GPAC MP4Box code-related vulnerabilities

GPAC MP4Box is a open-source multimedia packager from GPAC. It is primarily used for processing ISOBMF files such as MP4 and 3GP, but it can also be used for importing/exporting media from container files like AVI, MPG, MKV, and MPEG-2 TS. Version 2.4 of GPAC MP4Box has a code vulnerability cause...

CVE-2026-7125

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command injection. The attack may be initiated remotely. T...

CVE-2026-9476

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. This vulnerability affects the function setPasswordCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument admpass leads to os command injection. The attack can be...

CVE-2026-46144

The CVE-2026-46144 entry concerns the Linux kernel RDMA mana driver. A resource leak occurs during error unwind in mana_ib_create_qp_rss(), where mana_ib_cfg_vport_steering() is not properly cleaned up; this could cause resource exhaustion (DoS). The issue has been fixed in the kernel (patched), ...