ROOT-APP-MAVEN-CVE-2024-52317 CVE-2024-52317 in io.root.org.apache.tomcat.embed:tomcat-embed-core - Patched by Root

Root has patched CVE-2024-52317 in the io.root.org.apache.tomcat.embed:tomcat-embed-core package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2024-23672 CVE-2024-23672 in io.root.org.apache.tomcat.embed:tomcat-embed-websocket - Patched by Root

Root has patched CVE-2024-23672 in the io.root.org.apache.tomcat.embed:tomcat-embed-websocket package for Root:Maven. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48782 CVE-2026-48782 in pydantic-ai-slim - Patched by Root

Root has patched CVE-2026-48782 in the pydantic-ai-slim package for Root:PyPI. Multiple fixed versions available...

CVE-2026-18589 Wavlink WL-NU516U1 nas.cgi change_password stack-based overflow

A vulnerability was found in Wavlink WL-NU516U1 708c073-mt7628. This impacts the function changepassword of the file nas.cgi. The manipulation of the argument User1Passwd results in stack-based buffer overflow. The attack can be executed remotely. The exploit has been made public and could be use...

CVE-2026-18588

The CVE-2026-18588 affects the Wavlink WL-NU516U1 (708c073-mt7628) device, with a stack-based buffer overflow in nas.cgi caused by manipulation of CONTENT_LENGTH. This allows remote exploitation and could impact confidentiality, integrity, and availability. A fixed version has been released by th...

EUVD-2026-52167

A vulnerability has been found in Wavlink WL-NU516U1 708c073-mt7628. This affects the function fgets of the file nas.cgi. The manipulation of the argument CONTENTLENGTH leads to stack-based buffer overflow. Remote exploitation of the attack is possible. You should upgrade the affected component...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the IETFUtils.valueToString method, reached through X500Name.toString, equals, and hashCode via AbstractX500NameStyle, which escapes each special character with vBuf.insertindex, "\" on the same...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-ext-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path...

Improper Certificate Validation

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Certificate Validation in the check method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then treats t...

Improper Certificate Validation

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Certificate Validation in the check method of ProvOcspRevocationChecker, which verifies a stapled OCSP response's signature and then...

Improper Verification of Cryptographic Signature

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the verifySignature method of RSADigestSigner, whose legacy NULL-omitted DigestInfo path computes...

Improper Validation of Integrity Check Value

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value that leads to information exposure in the processPacket method of CCMBlockCipher, with equivalent...

Allocation of Resources Without Limits or Throttling

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the engineLoad method of BcFKSKeyStoreSpi, which reads HMAC PBKDF2 or scrypt cost parameters...

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value in the processPacket method of KCCMBlockCipher, which invokes processAAD only when associated data is present, so with no AAD the G1 block nonce, length, flag is never mixed into the MAC and...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in PKCS12KeyStoreSpi, which feeds the attacker-controlled KDF iteration count from a PKCS12 file's MAC data and encrypted bags into key derivation during engineLoad without enforcing...

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-jdk15 is a package is a Java implementation of cryptographic algorithms. This jar contains JCE provider and lightweight API for the Bouncy Castle Cryptography APIs for JDK 1.5. Affected versions of this package are vulnerable to Uncontrolled Recursion in the force...

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose nesting-depth...

Uncontrolled Recursion

Overview org.bouncycastle:bcprov-debug-jdk15on is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Uncontrolled Recursion in the force method of LazyEncodedSequence, which parses the deferred SEQUENCE with a fresh ASN1InputStream whose...

Memory Allocation with Excessive Size Value

Overview org.bouncycastle:bcprov-jdk12 is a Java implementation of cryptographic algorithms. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the toByteArray method of DefiniteLengthInputStream, which allocates new byteintremaining up front from t...

CVE-2026-18587 Wavlink WL-NU516U1 Config Import os command injection

A flaw has been found in Wavlink WL-NU516U1 708c073-mt7628. The impacted element is an unknown function of the component Config Import. Executing a manipulation of the argument Password can lead to os command injection. The attack may be launched remotely. This attack is characterized by high...