27602 matches found
CVE-2026-34392: Files or Directories Accessible to External Parties
LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory...
CVE-2025-50666
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /webpost.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request in parameters such as name, en, userid, log, and time...
CVE-2025-50650
A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to inadequate validation of input size in the routesstatic parameter in the /router.asp endpoint...
CVE-2025-50650
CVE-2025-50650 affects D-Link DI-8003 (firmware 16.07.26A1). A buffer overflow arises from inadequate validation of input size in the routes_static parameter of /router.asp. Documented as causing denial of service (availability impact) with high severity (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N...
D-Link DI-8003 security vulnerability
The D-Link DI-8003 is a wireless router from China-based AUO D-Link. The D-Link DI-8003 suffers from a buffer overflow vulnerability that originates from improper validation of the id parameter in the /thdmember.asp endpoint, which can be exploited by an attacker to cause a denial of service...
D-Link DI-8003 security vulnerability
The D-Link DI-8003 is a wireless router from China-based AUO D-Link. The D-Link DI-8003 suffers from a buffer overflow vulnerability caused by incorrect bounds checking of parameters in the /xwglref.asp endpoint, which can be exploited by an attacker to cause a denial of service...
D-Link DI-8003 security vulnerability
The D-Link DI-8003 is a wireless router from China-based AUO D-Link. The D-Link DI-8003 suffers from a buffer overflow vulnerability caused by incorrect boundary checking of the httplanport parameter in the /webgl.asp endpoint, which can be exploited by an attacker to cause a denial of service...
UTT 520W Router DoS
The vulnerability of the formConfigCliForEngineerOnly function in the UTT 520W router’s microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...
UTT HiPER 810G Router DoS
The vulnerability of the formGroupConfig function in the UTT HiPER 810G router’s microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause a service failure...
UTT HiPER 810G ConfigAdvideo DoS
The vulnerability of the ConfigAdvideo function in the UTT HiPER 810G router software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...
UTT 520W Router DoS
The vulnerability of the formFtpServerDirConfig function in the UTT 520W router software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow a malicious actor to cause service interruptions remotely...
UTT HiPER 810G Form Task Edit DoS
The vulnerability of the formTaskEdit function in the UTT HiPER 810G router’s microprogramming software is related to the copying of buffers without checking the size of the input data. Exploiting this vulnerability could allow an attacker to cause a service failure...
PT-2026-33564
Summary When kube-router is configured with per-node BGP peer passwords using the kube-router.io/peer.passwords node annotation, and verbose logging is enabled --v=2 or higher, the raw Kubernetes node annotation map is logged verbatim — including the base64-encoded BGP MD5 passwords. Anyone with...
CVE-2026-5678
A weakness has been identified in Totolink A7100RU 7.4cu.2313b20191024. The affected element is the function setScheduleCfg of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument mode can lead to os command injection. The attack may be launched remotely. The exploit has been...
CVE-2026-5687
A weakness has been identified in Tenda CX12L 16.03.53.12. This issue affects the function fromNatStaticSetting of the file /goform/NatStaticSetting. This manipulation of the argument page causes stack-based buffer overflow. The attack may be initiated remotely. The exploit has been made availabl...
Russia Hacked Routers to Steal Microsoft Office Tokens
Hackers linked to Russia's military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens...
Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to cross-site-scripting (CVE-2025-15599, CVE-2026-0540) and loss of confidentiality (CVE-2025-68470, CVE-2026-22029)
Summary Node.js modules DomPurify and React Router are used by IBM App Connect Enterprise Certified Container. IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to cross-site-scripting CVE-2025-15599, CVE-2026-0540 and loss of confidentiality CVE-2025-68470,...
CVE-2026-5604
A security flaw has been discovered in Tenda CH22 1.0.0.1. The impacted element is the function formCertLocalPrecreate of the file /goform/CertLocalPrecreate of the component Parameter Handler. Performing a manipulation of the argument standard results in stack-based buffer overflow. Remote...
CVE-2026-5677
A security flaw has been discovered in Totolink A7100RU 7.4cu.2313b20191024. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi. Performing a manipulation of the argument resetFlags results in os command injection. The attack may be initiated remotely. The exploit has been...
CVE-2026-5628
A security vulnerability has been detected in Belkin F9K1015 1.00.10. Impacted is the function formSetSystemSettings of the file /goform/formSetSystemSettings of the component Setting Handler. The manipulation of the argument webpage leads to stack-based buffer overflow. Remote exploitation of th...