28584 matches found
OpenViking security vulnerabilities
OpenViking is an open-source artificial intelligence proxy context database developed by Volcengine. Versions of OpenViking prior to 0.2.14 contained security vulnerabilities. These vulnerabilities stemmed from a lack of authentication in the bot proxy router, allowing unauthorized attackers to...
Tenda CH22 Router Code Execution
The vulnerability of the formQuickIndex function in the Tenda CH22 router’s microprogramming software lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by sending a specially crafted POST request...
D-Link DIR-1253 Router Privilege Escalation
The vulnerability of the /etc/shadow.sample file in D-Link DIR-1253 MESH router microprogramming software is related to insecure management of privileges. Exploiting this vulnerability could allow a malicious actor to elevate their privileges remotely...
boa formSchedule Code Execution
The vulnerability of the formSchedule function in the /goform/formSchedule file of the boa microprogramming system for D-Link DIR-619L routers is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
goahead D-Link DIR-816 Router Code Execution
The vulnerability of the /goform/form2Wl5RepeaterStep2.cgi file of the goahead component of the D-Link DIR-816 router software lies in buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...
D-Link DIR-816 Router Code Execution
The vulnerability of the /goform/form2WlanBasicSetup.cgi file of the goahead component of D-Link DIR-816 router microprogramming software is related to buffer overflow in the stack. Exploiting this vulnerability could allow an attacker operating remotely to execute arbitrary code...
D-Link DIR-816 Router Redirect.asp Token Extraction
The vulnerability of the redirect.asp file of the goahead component in D-Link DIR-816 router microprogramming software is related to deficiencies in access control and improper assignment of privileges. Exploiting this vulnerability allows an attacker to gain access to the redirect.asp page and...
Telnet CLI Arbitrary Command Execution
The vulnerability of the Telnet command-line interface CLI of TP-Link’s TL-MR6400 v5.3 router software relates to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary system command...
goahead Component Code Execution
The vulnerability of the /goform/form2Wl5BasicSetup.cgi file of the goahead component of the D-Link DIR-816 router software lies in a buffer overflow in the stack. Exploiting this vulnerability could allow an attacker to execute arbitrary code remotely...
CVE-2026-5204
A vulnerability was determined in Tenda CH22 1.0.0.1. Affected is the function formWebTypeLibrary of the file /goform/webtypelibrary of the component Parameter Handler. This manipulation of the argument webSiteId causes stack-based buffer overflow. The attack can be initiated remotely. The exploi...
EUVD-2026-17331
A vulnerability was determined in TRENDnet TEW-713RE up to 1.02. The affected element is the function sub421494 of the file /goform/addRouting. Executing a manipulation of the argument dest can lead to command injection. It is possible to launch the attack remotely. The exploit has been publicly...
CVE-2026-34472
Unauthenticated credential disclosure in the wizard interface in ZTE ZXHN H188A V6.0.10P2TE and V6.0.10P3N3TE allows unauthenticated attackers on the local network to retrieve sensitive credentials from the router's web management interface, including the default administrator password, WLAN PSK,...
elevendoc (>=0.1.3, <=1.2.4), llm-adaptive-router (>=0.1.0, <=0.1.12) potentially affected by CVE-2026-34070 via langchain-core (0.3.8)
langchain-core PYPI version 0.3.8 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - elevendoc =0.1.3, =0.1.0, =0.1.12 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...
Tenda AC21 Router DoS
The vulnerability of the formSetQosBand function /goform/SetNetControlList of the Tenda AC21 router’s software lies in the fact that the operation’s output is stored outside of the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failure by sending a...
Incorrect Privilege Assignment
Overview Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the CapFQDN.DecodeFromBytes function of the BGP OPEN Message Handler. An attacker can bypass intended access controls by manipulating the domainNameLen argument remotely, potentially resulting in...
kernel: Linux kernel:A use-after-free in bridge multicast in br_multicast_port_ctx_init
A flaw was found in the Linux kernel's bridge multicast functionality. A local user could trigger a use-after-free vulnerability, a type of memory corruption, by improperly configuring network bridge router ports. This issue arises because the system fails to correctly remove ports from its...
CVE-2026-5042
A security flaw has been discovered in Belkin F9K1122 1.00.33. The affected element is the function formCrossBandSwitch of the file /goform/formCrossBandSwitch of the component Parameter Handler. The manipulation of the argument webpage results in stack-based buffer overflow. The attack may be...
A week in security (March 23 – March 29)
Last week on Malwarebytes Labs: Criminals are renting virtual phones to bypass bank security Bogus Avast website fakes virus scan, installs Venom Stealer instead Infiniti Stealer: a new macOS infostealer using ClickFix and Python/Nuitka GlassWorm attack installs fake browser extension for...
CVE-2026-5105
A vulnerability was detected in Totolink A3300R 17.0.0cu.557b20221024. The affected element is the function setVpnPassCfg of the file /cgi-bin/cstecgi.cgi of the component Parameter Handler. Performing a manipulation of the argument pptpPassThru results in command injection. It is possible to...
CVE-2026-5103
A weakness has been identified in Totolink A3300R 17.0.0cu.557b20221024. This issue affects the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument enable causes command injection. The attack is possible to be carried out remotely. The exploit has been made...