CVE-2026-36538

Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account is set to the trivially weak value root, allowing an attacker with access to the device to authenticate as root and gain full control of the underlying...

CVE-2026-4377

Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number. This issue was fixed in version 1.00B16CP...

CVE-2026-4377

Dlink DWR-X1820 router uses weak default password generated from its IMEI number and does not require users to change it. An attacker who knows how passwords are generated can easily crack the default password if they have the device IMEI number. This issue was fixed in version 1.00B16CP...

D-Link DWR-X1820 security vulnerability

The D-Link DWR-X1820 is a wireless router produced by D-Link Corporation. The D-Link DWR-X1820 has a security vulnerability. This vulnerability stems from the use of weak default passwords generated from the IMEI number, and no requirement is placed on users to change them. As a result, attackers...

CVE-2026-44593: Improper Limitation of a Pathname to a Restricted Directory

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, the legacy router first retrieves a response from legacyServer, parses the incoming request path, and ultimately writes the data to storage via buildStorage.Put. The router concatenates the path components...

Tenda F1202 Router Code Execution

The vulnerability of the formWrlExtraSet function in the Tenda F1202 router’s microprogramming software is related to the issue of the operation exceeding the buffer boundaries in memory when processing the GO parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary...

Tenda F1202 fromSafeEmailFilter Code Execution

The vulnerability of the from SafeEmailFilter function in the Tenda F1202 router software is related to the execution of an operation outside the buffer in memory when processing the page parameter. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code or cause...

TOTOLINK N300RH setPasswordCfg() Code Execution

The vulnerability of the setPasswordCfg function in the /cgi-bin/cstecgi.cgi script of the TOTOLINK N300RH router’s microprogramming software is related to the lack of data cleaning measures at the control level when processing the admpass parameter. Exploiting this vulnerability allows a malicio...

PT-2026-44402

SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9 B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints mgmt.php, npcmd.php that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the...

Tenda F1202 Router Code Execution

The vulnerability of the fromPPTPUserSetting function in the Tenda F1202 router’s microprogramming software is related to the issue of the operation going beyond the buffer boundaries in memory when processing the delno parameter. Exploiting this vulnerability allows a remote attacker to execute...

CVE-2026-5509

An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system commands through the web management interface. After successfully authenticating to the admin interface, an attacker can leverage the...

CVE-2026-5509

An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system commands through the web management interface. After successfully authenticating to the admin interface, an attacker can leverage the...

EUVD-2026-32611

An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system commands through the web management interface. After successfully authenticating to the admin interface, an attacker can leverage the...

CVE-2026-5509

The CVE-2026-5509 entry describes an authenticated command-injection flaw in TP-Link Archer BE450 v1 and BE7200 v1 routers. After logging into the admin web interface, an attacker can inject crafted input via the browser’s developer console that is passed to backend system commands without suffic...

EUVD-2026-32555

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, PCF NpcfSMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI. In NewServer, the smPolicyGroup route group is created and routes are...

axolotl (0.13.0.dev0), lazyllm (>=0.7.0, <=0.7.2) +5 more potentially affected by CVE-2026-48545 via gradio (5.49.1)

gradio PYPI version 5.49.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - axolotl 0.13.0.dev0 - lazyllm =0.7.0, =0.1.4, =0.1.7, =0.4.1 Source cves: CVE-2026-48545 Source advisory: OSV:GHSA-7HP7-4P35-3CX2...

CVE-2026-36539

Netis AC1200 Router NC21 V4.0.1.4296 exposes a CGI endpoint /cgi-bin/skkget.cgi that returns the entire router configuration as a JSON response with no authentication required. Any attacker on the LAN can send a single HTTP GET request and instantly retrieve administrator credentials, WiFi...

CVE-2026-36538

Netis AC1200 Router NC21 V4.0.1.4296 contains a hard-coded root credential stored in /etc/shadow.sample. The password for the root account is set to the trivially weak value root, allowing an attacker with access to the device to authenticate as root and gain full control of the underlying...

CVE-2026-9295

A security flaw has been discovered in Edimax BR-6428NS 1.10. This affects the function formWirelessTbl of the file /goform/formWirelessTbl of the component POST Request Handler. Performing a manipulation of the argument vapurl results in buffer overflow. The attack can be initiated remotely. The...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.32 security and extras update

Red Hat OpenShift Container Platform release 4.19.32 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a security impact of...