33904 matches found
EUVD-2026-90278
An authenticated administrator could bypass the content validation applied to an administrative file upload and store a file containing dangerous content on the appliance. This did not by itself result in code execution, which would require a separate vulnerability to run the stored file...
EUVD-2026-90277
An authenticated administrator on a node with an optional, separately licensed gateway role enabled could supply a connector URL that the server retrieved without sufficient validation of its scheme or destination, causing the server to issue requests to internal network services. Exploitation...
EUVD-2026-90274
An authenticated administrator could initiate an administrative import using a file whose contents were not fully verified, because the import validated only the file's header rather than the complete file. This could allow unverified or forged content to be accepted and processed, affecting the...
EUVD-2026-90270
An unauthenticated attacker could cause a file with attacker-controlled content to be written to the appliance filesystem through an administrative upload handler that did not properly authenticate the request. This did not by itself result in code execution, which would require a separate...
EUVD-2026-90381
An authenticated administrator could cause the server to issue requests to, and interact with, internal network services that are not meant to be reachable through this interface. On its own this did not result in code execution...
EUVD-2026-90077
A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its snicallback assigns a different context to SSLSocket.context the documented way to select a certificate per server name and nothing else keeps the original ssl.SSLContext alive. Typical cases are...
EUVD-2026-89843
Subscriber Privilege Escalation in Import and export users and customers = 2.5.2 versions...
EUVD-2026-89729
Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this may lead to incorrect reads or writes, or to corruption of internal memory structures. An authenticated remote attacker with monitoring access can exploit...
EUVD-2026-89467
The device's update mechanism includes conditions that allow unauthorized software packages to be accepted as authentic. During the boot process, the stock done function disables signature verification in the OPKG configuration before restoring optional packages from a writable, unsigned feed...
EUVD-2026-89468
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted POST request...
EUVD-2026-89474
The application accepts user-supplied session identifiers and does not regenerate the session ID after authentication. This allows an attacker to predefine a session ID and reuse it after victim authentication, resulting in session takeover...
EUVD-2026-89475
The application uses unsafe functions that allow execution of inline scripts and string evaluation functions...
EUVD-2026-89460
An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination...
EUVD-2026-89193
Unbounded PPP IPCP Option Parsing Causes a Worker Stall and Out-of-bounds Read...
EUVD-2026-89191
Out-of-bounds Read from Unvalidated MSRP Attribute List Length...
EUVD-2026-89190
NULL Pointer Dereference When Evicting the Sole MSRP Attribute...
EUVD-2026-89189
NULL Pointer Dereference on MSRP Attribute Table Exhaustion...
EUVD-2026-89177
nxicmpv6validateoptions scans the option area with while length 2 common/src/nxicmpv6validateoptions.c:79. An area whose size leaves a one- or two-byte residue exits the loop with that tail unexamined; the residue is not negative, so the function returns NXSUCCESS. Its zero-length rejection never...
EUVD-2026-88972
The access to the service menu is obfuscated, but possible with only physical access. This menu exposes sensitive information such as serial numbers, MAC addresses, and WiFi network and password...