27405 matches found
Tenda F453 Router Code Execution
The vulnerability of the fromwebExcptypemanFilter function /goform/webExcptypemanFilter in the Tenda F453 router software lies in the issue where the operation exits beyond the buffer in memory when processing the page parameter. Exploiting this vulnerability allows a remote attacker to execute...
D-Link DIR-513 Router Buffer Overflow
The vulnerability of D-Link DIR-513 router’s microprogramming software is related to the fact that the operation results are written outside the buffer in memory when processing the curTime parameter. Exploiting this vulnerability can allow a remote attacker to cause a service failure...
D-Link DIR-513 Router FormEasySetTimezone Heap Buffer Overflow DoS
The vulnerability of the formEasySetTimezone function /goform/formEasySetTimezone in the embedded web server software of D-Link DIR-513 routers is related to the issue of data being written outside of the buffer in memory when processing the curTime parameter. Exploiting this vulnerability could...
Tenda F453 Router Sub_3C6C0 Function Code Execution
The vulnerability of the sub3C6C0 function /goform/QuickIndex of the Tenda F453 router’s microprogramming system is related to the operation that goes beyond the buffer in memory when processing parameters mitlinktype and PPPOepassword. Exploiting this vulnerability allows a remote attacker to...
D-Link DIR-513 Router Buffer Overflow
The vulnerability of D-Link DIR-513 router microprogramming software arises due to buffer overflow when processing the curTime parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code and cause service failures...
PT-2026-52855
Name of the Vulnerable Software and Affected Versions Echo versions prior to 4.15.3 Echo versions prior to 5.2.0 Description A discrepancy exists between the router and the static file handler regarding URL path decoding. The router matches routes using the raw encoded path, preserving %2F as-is,...
CVE-2026-55677: Improper Limitation of a Pathname to a Restricted Directory
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...
CVE-2026-55677: Improper Limitation of a Pathname to a Restricted Directory
Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router matches routes using the raw encoded path preserving %2F as-is, while StaticDirectoryHandler unescapes %2F to / before resolving filesystem paths. This allows an...
CVE-2026-42342
A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denia...
GO-2026-5653 kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.com/cloudnativelabs/kube-router
kube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection in github.com/cloudnativelabs/kube-router...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...
Improper Authentication
Overview Affected versions of this package are vulnerable to Improper Authentication via the unauthenticated router-key and mcp-init-host paths. An attacker can gain unauthorized access or bypass authentication controls by sending crafted requests to these endpoints. Remediation Upgrade...
GO-2026-5354 kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level in github.com/cloudnativelabs/kube-router
kube-router: BGP Peer Passwords Exposed in Logs at Verbose Logging Level in github.com/cloudnativelabs/kube-router...
GO-2026-5390 MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway
MCP Gateway: Authority-injection and JWT/session bypass via the unauthenticated router hair-pin "router-key" / "mcp-init-host" path in github.com/Kuadrant/mcp-gateway...
GO-2026-5082 Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger in github.com/fission/fission
Fission router exposes /fission-function// on its public listener, allowing invocation of any function without an HTTPTrigger in github.com/fission/fission...
