Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization due to mishandling access control to private resources. An attacker can gain unauthorized access to private resources by using an API token that is restricted to public resources. Remediation Upgrade...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via inadequate enforcement of branch delete permissions after merging a pull request. An attacker can delete arbitrary branches. Remediation Upgrade github.com/go-gitea/gitea/routers/web/repo to version 1.22.5 or...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via inadequate enforcement of branch delete permissions after merging a pull request. An attacker can delete arbitrary branches. Remediation Upgrade code.gitea.io/gitea/routers/web/repo to version 1.22.5 or highe...

UTT 512W security vulnerabilities

The UTT Progress 512W is an enterprise-grade wireless router designed for small office or home office SOHO environments for network scenarios with up to 50 people. The UTT Progressive 512W suffers from a buffer overflow vulnerability that originates from the incorrect operation of the strcpy...

Express adapter React Router routing library React Remix DoS

The vulnerability of the Express adapter related to the React Router routing library in the Remix framework is linked to shortcomings in HTTP request handling. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

Tenda AC18 sprintf Buffer Overflow DoS

The vulnerability of the sprintf function in Tenda AC18 router microprogramming software is related to the execution of operations outside the buffer in memory when processing the scanList parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause service...

Wavlink NU516U1 Arbitrary Command Execution

The vulnerability of sub4016F0 in the microprogrammed Wavlink NU516U1 router software is related to the failure to take measures for data cleaning at the control level when processing the delflag argument. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands via PO...

Wavlink NU516U1 Router Sub_403198 Function Arbitrary Command Execution

The vulnerability of the sub403198 function in the /cgi-bin/wireless.cgi script of the Wavlink NU516U1 router’s microprogramming system is related to the lack of measures taken to clean data at the control level when processing the mac5g parameter. Exploiting this vulnerability could allow a remo...

Wavlink NU516U1 DeleteMac Component Sub_402D1C Arbitrary Command Execution

The vulnerability of component DeleteMac Page’s sub402D1C function in the Wavlink NU516U1 microprogramming system lies in the failure to take data cleaning measures at the control level when processing the deletelist argument. Exploiting this vulnerability allows an attacker to execute arbitrary...

Wavlink NU516U1 Sub Function Arbitrary Command Execution

The vulnerability of function sub401778 in the microprogrammed Wavlink NU516U1 router software is related to the lack of measures taken to clean data at the control level when processing the argument dmzflagt. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands...

App Router Next.js Vercel CLI compromise Data Compromise

The vulnerability of the App Router router on the Next.js software development platform and the Vercel command-line interface CLI platform is related to shortcomings in HTTP request processing. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected...

Wavlink NU516U1 Delete_Mac_list Arbitrary Command Execution

The vulnerability of the DeleteMaclist component of the sub4030C0 function in the Wavlink NU516U1 microprogramming system lies in the failure to take data cleaning measures at the control level when processing the deletelist argument. Exploiting this vulnerability allows an attacker to execute...

Tenda AC18 strcpy Heap Buffer Overflow DoS

The vulnerability of the strcpy function in the microprogramming software for Tenda AC18 routers is related to the operation that goes beyond the buffer boundaries in memory when processing the mac argument. Exploiting this vulnerability allows a remote attacker to execute arbitrary code or cause...

UTT 512W security vulnerabilities

The UTT Progressive 512W is an enterprise-grade wireless router from Atech UTT designed for small and medium-sized businesses SOHO and similarly sized network environments for access scenarios of 30 to 50 users. UTT Progressive 512W suffers from a buffer overflow vulnerability that originates fro...

UTT Progressive 512W Memory Corruption Vulnerability

The UTT Progressive 512W is an enterprise-grade wireless router from Atech UTT designed for small and medium-sized businesses SOHO and similarly sized network environments for access scenarios of 30 to 50 users. The UTT Progress 512W suffers from a memory corruption vulnerability that originates...

JD Cloud BE6500 command injection vulnerability

The JD Cloud BE6500 is a WiFi router from the Chinese company Jingdong JD. A command injection vulnerability exists in the JD Cloud BE6500 version 4.4.1.r4308, which stems from misuse of the parameter ddnsname of the function sub4780 in the file /jdcapi, which could lead to a command injection...

FreeBSD rtsold 15.x - Remote Code Execution via DNSSL

Exploit Title: FreeBSD rtsold 15.x - Remote Code Execution via DNSSL Date: 2025-12-16 Exploit Author: Lukas Johannes Möller Vendor Homepage: https://www.freebsd.org/ Version: FreeBSD 13.x, 14.x, 15.x before 2025-12-16 patches Tested on: FreeBSD 14.1-RELEASE CVE: CVE-2025-14558 Description: rtsold...

CVE-2025-68376 coresight: ETR: Fix ETR buffer use-after-free issue

In the Linux kernel, the following vulnerability has been resolved: coresight: ETR: Fix ETR buffer use-after-free issue When ETR is enabled as CSMODESYSFS, if the buffer size is changed and enabled again, currently sysfsbuf will point to the newly allocated memorybufnew and free the old...

Security Risks Introduced by Weak Authentication in Smart Home IoT Systems

Smart home IoT systems rely on authentication mechanisms to ensure that only authorized entities can control devices and access sensitive functionality. In practice, these mechanisms must balance security with usability, often favoring persistent connectivity and minimal user interaction. This...

MAL-2025-192803 Malicious code in init-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d018c8963d1a91fc672bfe128a7699635fb3dd34a7df393119baee24d44a3d0 The package init-router was found to contain malicious code...