CVE-2026-55677

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

D-link DIR-823X Router Command Execution

The vulnerability of D-link DIR-823X router microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Tenda FH1202 Router Code Execution

The vulnerability of the fromP2pListFiltert function /goform/P2pListFilter of the Tenda FH1202 router’s software lies in the escape of the operation outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service failures...

Tenda F453 Router Code Execution

The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the Tenda F453 router software lies in the issue where the operation exits beyond the buffer in memory when processing the page parameter. Exploiting this vulnerability allows a remote attacker to execute...

D-Link DIR-513 Router Buffer Overflow

The vulnerability of D-Link DIR-513 router’s microprogrammed software is related to the operation of writing data outside the buffer in memory when processing the curTime parameter. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

D-Link DIR-513 Router Buffer Overflow

The vulnerability of D-Link DIR-513 router’s microprogramming software lies in the fact that the operation data is written outside the buffer in memory when processing the webpage parameter. Exploiting this vulnerability allows a remote attacker to cause a service failure by sending specially...

D-Link DIR-513 Router FormEasySetTimezone Heap Buffer Overflow DoS

The vulnerability of the formEasySetTimezone function /goform/formEasySetTimezone in the embedded web server software of D-Link DIR-513 routers is related to the issue of data being written outside of the buffer in memory when processing the curTime parameter. Exploiting this vulnerability could...

UTT HiPER 810G Router strcpy Buffer Overflow DoS

The vulnerability of the strcpy function /goform/getOneApConfTempEntry in the UTT HiPER 810G router software is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

UTT HiPER 810G Router strcpy Buffer Overflow DoS

The vulnerability of the strcpy function /goform/formConfigDnsFilterGlobal in the UTT HiPER 810G router software lies in the possibility of the operation being executed outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

Tenda F453 Router Sub_3C6C0 Function Code Execution

The vulnerability of the sub3C6C0 function /goform/QuickIndex of the Tenda F453 router’s microprogramming system is related to the operation that goes beyond the buffer in memory when processing parameters mitlinktype and PPPOepassword. Exploiting this vulnerability allows a remote attacker to...

D-Link DIR-513 Router Buffer Overflow

The vulnerability of D-Link DIR-513 router’s microprogramming software is related to the fact that the operation results are written outside the buffer in memory when processing the curTime parameter. Exploiting this vulnerability can allow a remote attacker to cause a service failure...

D-Link DIR-513 Router Buffer Overflow

The vulnerability of D-Link DIR-513 router microprogramming software arises due to buffer overflow when processing the curTime parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and cause service failures...

CVE-2026-55677: Improper Limitation of a Pathname to a Restricted Directory

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

CVE-2026-55677: Improper Limitation of a Pathname to a Restricted Directory

Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...

PT-2026-52855

Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.15.3 Echo versions prior to 5.2.0 Description A discrepancy exists between the router and the static file handler regarding URL path decoding. The router matches routes using the raw encoded path, preserving %2F as-is,...

CVE-2026-47221: NULL Pointer Dereference

Envoy is an open source edge and service proxy designed for cloud-native applications. From 1.18.0 until 1.35.13, 1.36.9, 1.37.5, and 1.38.3, the router filter contains a null pointer dereference vulnerability when handling HTTP 303 See Other internal redirects for body-less non-GET/HEAD requests...

PT-2026-52884

Name of the Vulnerable Software and Affected Versions Envoy versions 1.18.0 through 1.35.12 Envoy versions 1.36.0 through 1.36.8 Envoy versions 1.37.0 through 1.37.4 Envoy versions 1.38.0 through 1.38.2 Description The router filter contains a null pointer dereference—a condition where the softwa...

CVE-2026-42342

A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denia...

GO-2026-5653 kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.com/cloudnativelabs/kube-router

kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.com/cloudnativelabs/kube-router...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...