Malicious code in @angularr/router (npm)

@angularr/[email protected] impersonates router it copies the code and metadata of the pillarjs router package and adds a preinstall script that runs on npm install and pipes a remotely hosted loader into node: curl -L...

CVE-2022-46080

CVE-2022-46080 Nexxt Router 15.03.06.60 Authentication Bypass and Remote Command Execution...

CVE-2020-12124

Anatomy of an IoT Exploit, from Hands-On to RCE originally at https://www.klogixsecurity.com/scorpion-labs-blog/anatomy-of-an-iot-exploit-from-hands-on-to-rce by David E. Baker, published on June 1, 2023 Foreword This study concerns the firmware of the Wavlink Wireless-AC1200 Gigabit router as of...

CVE-2023-38120

Exploit: This is a POC for a bug that I found in SmartRG router CVE-2023-38120. It's already fixed by the manufacturer...

Tenda Router AC11 - Remote Command Injection

Tenda Router AC11 is susceptible to remote command injection vulnerabilities in the web-based management interface that could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. id: CVE-2021-31755 info: name: Tenda Router AC11 - Remote Comman...

SDT-CW3B1 1.1.0 - OS Command Injection

Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. id: CVE-2021-46422 info: name: SDT-CW3B1 1.1.0 - OS Command Injection author: badboycxcc,prajiteshsingh severity: critical description: ...

[SECURITY] Fedora 45 Update: ramond-0.5-33.fc45

This program monitors IPv6 networks for router advertisements. When an advertisement is received, a configurable action occurs...

AlmaLinux 9.2 [TuxCare] Security Update: osbuild-composer / osbuild-composer-core / etc (ALMALINUX9.2:CLSA-2026:1790972556)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1790972556 advisory. - Echo is a Go web framework. Prior to 4.15.3 and 5.2.0, Echo's router and static file handler disagree on URL path decoding. The router...

CVE-2026-94543

A flaw was found in Next.js. In self-hosted applications using the Pages Router with static generation or Incremental Static Regeneration ISR, response cache entries are not sufficiently bound to their source route. A remote attacker can exploit this issue by sending crafted requests to replace a...

asus-cmd

ASUS Router infosvr UDP Broadcast root Command Execution Several models of ASUS's routers include a service called infosvr that listens on UDP broadcast port 9999 on the LAN or WLAN interface. It's used by one of ASUS's tools to ease router configuration by automatically locating routers on the...

Security Bulletin: Multiple secuirty vulnerabilities addressed with IBM Business Automation Workflow traditional and containers September 2026

Summary In addition to updating many operating system level packages, IBM Business Automation Workflow traditional and container fixes address the following vulnerabilities. Vulnerability Details CVEID:CVE-2026-53668 DESCRIPTION: React Router is a router for React. In versions 6.30.2 through 6.30...

DIR8xx_PoC

phpcgi phpcgi is responsible for processing requests to .php, .asp and .txt pages. Also, it checks whether a user is authorized or not. Nevertheless, if a request is crafted in a proper way, an attacker can easily bypass authorization and execute a script that returns a login and password to a...

CVE-2026-94543

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94485 Next.js: Information disclosure in Next.js App Router metadata image routes via dynamicParams bypass

Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read t...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543

The Next.js framework (versions 15.0.0 through 15.5.27 and 16.3.8 ) is vulnerable to cache poisoning in self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration (ISR) pages. The root cause is that response cache entries are not sufficiently boun...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...

CVE-2026-94543 Next.js: Cache poisoning of SSG and ISR pages in self-hosted Next.js applications

Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the...