CVE-2025-41766

A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise...

CVE-2025-41766

A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise...

CVE-2025-41767

A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass vulnerability in the wwwupdate.cgi method in the web interface of UBR...

CVE-2025-41766

The CVE-2025-41766 issue is a stack-based buffer overflow found while parsing web requests via the ubr-network method. A low-privileged remote attacker can exploit a crafted HTTP POST to trigger the overflow, leading to full device compromise. Documented details include the vulnerability type, at...

CVE-2025-41766

A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise...

CVE-2025-41766 Stack buffer overflow on parsing web request

A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise...

CVE-2025-41766 Stack buffer overflow on parsing web request

A low-privileged remote attacker can trigger a stack-based buffer overflow via a crafted HTTP POST request using the ubr-network method resulting in full device compromise...

CVE-2025-41758 Arbitrary Write with wwwupload.cgi

A low-privileged remote attacker can exploit an arbitrary file write vulnerability in the wwupload.cgi endpoint. Due to path traversal this can lead to overwriting arbitrary files on the device and achieving a full system compromise...

PT-2026-24036

Name of the Vulnerable Software and Affected Versions MBS UBR-01 Mk II affected versions not specified Description A low-privileged remote attacker can trigger a stack-based buffer overflow by sending a crafted HTTP POST request using the ubr-network method, potentially leading to full device...

PT-2026-24037

Name of the Vulnerable Software and Affected Versions UBR affected versions not specified Description A high-privileged remote attacker can fully compromise the device by abusing an update signature bypass in the web interface. The issue resides in the wwwupdate.cgi method. Recommendations At the...

Malicious code in @shenira/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3952357e13678bb1abb18600854c622a3c5596cff93e8cc3ba309a6f51fccb1f The package @shenira/baileys was found to contain malicious code. Source: ghsa-malware a2914e7416552719c1008f077553702efc5d7710bc760aa34eeaeede86535b...

MAL-2026-1215 Malicious code in whop-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 943bd287cb6375798fdee15ba33f85737201ea9934952ee5d1f2a2336e8cd65c The package whop-sdk was found to contain malicious code. Source: ghsa-malware 4c3e9ca78194532c222b978afd00f7bb4be1ca1ba6cd442e1892d17ee6e67ccc Any...

Malicious code in polmarket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11f6a7f9b6e3b1841c2ab98dd4f2b65abf89d0ff9632d58fe14a1b2b9f5ac846 The package polmarket was found to contain malicious code. Source: ghsa-malware be6a87de77c124ff75dbce268ef62ae226ca99de2026d5178d14f6b38ba0888b Any...

Malicious code in danzxoffc74-libsignal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 82a41216321e9b425e7d33eef60ae4d705b659dad737e18b8a84bee404d031e4 The package danzxoffc74-libsignal was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1146 Malicious code in danzxoffc74 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0e877557d9e7863e313c0524e6752daab739308df7d062c227dc45da6422e06a The package danzxoffc74 was found to contain malicious code. Source: ghsa-malware c665df7f545b35a9e4e23e8bddad61473e5846f08a58ed73bcbb16688239421e An...

MAL-2026-1033 Malicious code in duer-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a6a00caf26e2e34291c939e8d0351324c884ba9d9c5b74e5cb9c8d78177a999 The package duer-js was found to contain malicious code. Source: ghsa-malware e7255816711503f7b2f4febb10e3d2d8ef36d2e3067366ece224ad3816fbf03c Any...

MAL-2026-960 Malicious code in hardhta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc27417b62c3ad399e369577764608120ee2b3662367f1d51bf5fb8378560bcf The package hardhta was found to contain malicious code. Source: ghsa-malware e4174e96a92d9c0d7bbe499ed40d2e4cab9635c61471a1602fd117d8115e2d38 Any...

Malicious code in json-mapping-src (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc958aaacb5ea616283510ccda98b0a4634c35d348eece1613366ac66ad41abb The package json-mapping-src was found to contain malicious code. Source: ghsa-malware 8e7f8a61a6a361880bea88321b1f130627266e5f1d54e8aa9d9f47d64c99db...

CVE-2026-0652

On TP-Link Tapo C260 v1, command injection vulnerability exists due to improper sanitization in certain POST parameters during configuration synchronization. An authenticated attacker can execute arbitrary system commands with high impact on confidentiality, integrity and availability. It may cau...

MAL-2026-835 Malicious code in sap-code-style-guides (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13203a88392c91986f587e28ca25120b54f0c4d4ee5dd2c330c2bbbe6243203a The package sap-code-style-guides was found to contain malicious code. Source: ghsa-malware...