27031 matches found
EUVD-2026-53301
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...
CVE-2026-66747
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...
PT-2026-68096
Name of the Vulnerable Software and Affected Versions Zbtlink router firmware affected versions not specified Description Zbtlink router firmware contains an embedded remote-control implant known as ENDLESSDOORS, which is integrated as an OpenWrt package librctl.so. The implant runs as root under...
CVE-2026-66747: Embedded Malicious Code
Zbtlink router firmware ships an embedded remote-control implant, ENDLESSDOORS, present in every published build across the product line. It is the open-source ycsunjane/rctl tool built in as an OpenWrt package librctl.so, started at boot and run as root under the process name kworker to blend in...
GL.iNet GL-MT3000 Router Command Injection
The vulnerability of the removeprofile function at the /cgi-bin/glc endpoint of the modem.so component of the GL.iNet GL-MT3000 router software lies in the lack of measures to sanitize input data. Exploiting this vulnerability could allow an attacker to inject arbitrary commands remotely...
nas-web.add_user Arbitrary Command Execution
The vulnerability of the nas-web.adduser function in the GL.iNet GL-MT3000 router microprogramming system is related to the failure to take measures to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
Improper Authorization
Overview ghost is a publishing platform Affected versions of this package are vulnerable to Improper Authorization in RouterController.getSubscriptionCheckoutData through the subscription offer redemption flow in core/server/controllers/router.js. An attacker can redeem an archived or otherwise...
aimmo (>=0.69.7b417, <=0.69.8), cfl-common (>=4.30.7, <=4.30.8) +2 more potentially affected by CVE-2026-15307 via django (2.2.21)
django PYPI version 2.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.69.7b417, =4.30.7, =4.30.7, =4.30.8 - rapid-router 2.7.5 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
aimmo (>=0.69.9b442, <=0.69.10b450), cfl-common (>=4.30.9, <=4.30.10) +2 more potentially affected by CVE-2026-15307 via django (2.2.22)
django PYPI version 2.2.22 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.69.9b442, =4.30.9, =4.30.9, =4.30.10 - rapid-router 2.7.6 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
aimmo (>=0.69.11b455, <=1.3.1), cfl-common (>=4.30.11, <=5.26.4) +6 more potentially affected by CVE-2026-15307 via django (2.2.24)
django PYPI version 2.2.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.69.11b455, =4.30.11, =4.30.11, =0.1.1, =0.9.7, =3.11.0, =2.0.0, =2.7.7, =3.4.4 Source cves: CVE-2026-15307 Source advisory:...
rapid-router (>=1.0.0.post0.dev74, <=1.0.0.post0.dev405) potentially affected by CVE-2026-15307 via django (1.8.2)
django PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev74, =1.0.0.post0.dev405 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-15307 via django (1.11.24)
django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-15307 Source advisory: OSV:GHSA-WVQV-FJ8W-QMHM...
rapid-router (>=1.0.0.post0.dev74, <=1.0.0.post0.dev405) potentially affected by CVE-2026-15830 via django (1.8.2)
django PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev74, =1.0.0.post0.dev405 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-15830 via django (1.11.24)
django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
aimmo (>=0.69.7b417, <=0.69.8), cfl-common (>=4.30.7, <=4.30.8) +2 more potentially affected by CVE-2026-15830 via django (2.2.21)
django PYPI version 2.2.21 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.69.7b417, =4.30.7, =4.30.7, =4.30.8 - rapid-router 2.7.5 Source cves: CVE-2026-15830 Source advisory: OSV:GHSA-Q238-5CXM-5C9H...
aimmo (>=0.28.0b5241, <=0.61.8b52), cfl-common (>=3.1.4, <=4.14.2) +2 more potentially affected by CVE-2026-15830 via django (1.11.24)
django PYPI version 1.11.24 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - aimmo =0.28.0b5241, =3.1.4, =2.19.0, =2.2.0, =2.4.12 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...
rapid-router (>=1.0.0.post0.dev74, <=1.0.0.post0.dev405) potentially affected by CVE-2026-15830 via django (1.8.2)
django PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - rapid-router =1.0.0.post0.dev74, =1.0.0.post0.dev405 Source cves: CVE-2026-15830 Source advisory: OSV:PYSEC-2026-3717...
Malicious code in @servicetitan/hash-browser-router (npm)
npm/@servicetitan/hash-browser-router is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized a...
