Lucene search
+L

23677 matches found

Positive Technologies
Positive Technologies
added 2026/06/03 12:0 a.m.18 views

PT-2026-45990

Name of the Vulnerable Software and Affected Versions Mercusys AC12G EU V1 version AC12GEU V1 200909 Description The UPnP GetStatusInfo action discloses kernel memory layout. An unauthenticated attacker on the adjacent network can obtain a raw MIPS KSEG0 kernel pointer, which reveals the kernel...

4.3CVSS5.5AI score0.00166EPSS
SaveExploits0References3
Positive Technologies
Positive Technologies
added 2026/06/03 12:0 a.m.24 views

PT-2026-45995

Mercusys AC12G EU V1 router with firmware AC12GEU V1 200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint code=10, which lacks the rate limiting applied to the login endpoint code=7. An attacker on the adjacent network can attempt unlimited passwords without...

8.8CVSS5.8AI score0.00181EPSS
SaveExploits0References2
Vulnrichment
Vulnrichment
added 2026/06/03 12:0 a.m.11 views

CVE-2026-36607

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 allows unauthenticated brute-force attacks via the TDDP password change endpoint code=10, which lacks the rate limiting applied to the login endpoint code=7. An attacker on the adjacent network can attempt unlimited passwords without...

5.8AI score0.00181EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/06/03 12:0 a.m.27 views

PT-2026-46085

When using React Router v7 in Framework Mode, there exists a combination of steps that could potentially allow unauthorized RCE through external requests. This first requires the application code to have an existing prototype pollution vulnerability. This can be leveraged into a 2-step attack in...

8.1CVSS5.9AI score0.00416EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/06/03 12:0 a.m.26 views

EUVD-2026-34144

Mercusys AC12G EU V1 router with firmware AC12GEUV1200909 is vulnerable to a HTTP denial of service via a low number of crafted incomplete HTTP requests, causing a persistent crash that requires physical power cycling to recover...

6.5CVSS5.8AI score0.00177EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/03 12:0 a.m.39 views

CVE-2026-36602

CVE-2026-36602 affects the Mercusys AC12G (EU) V1 router with firmware AC12G(EU)_V1_200909. The issue arises in UPnP GetStatusInfo handling, which discloses kernel memory layout. An unauthenticated attacker on an adjacent network can obtain a raw MIPS KSEG0 kernel pointer, exposing kernel memory ...

4.3CVSS5.8AI score0.00166EPSS
SaveExploits0References1
CVE
CVE
added 2026/06/03 12:0 a.m.26 views

CVE-2026-36604

Mercusys AC12G (EU) V1 router vulnerable to DNS rebinding due to HTTP Host header validation failure in firmware AC12G(EU)_V1_200909. An external attacker could rebound a domain to the router’s internal IP, taking advantage of an existing CORS wildcard weakness (Access-Control-Allow-Origin: *). C...

6.5CVSS5.8AI score0.00254EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/06/02 11:53 p.m.22 views

CVE-2026-44575

A flaw was found in Next.js. App Router applications that use middleware or proxy-based authorization checks are vulnerable to unauthorized access. A remote attacker can exploit this by crafting specific .rsc and segment-prefetch URLs, which bypass the intended middleware rules. This allows acces...

7.5CVSS5.7AI score0.01558EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/06/02 11:53 p.m.21 views

CVE-2026-44573

A flaw was found in Next.js. Applications utilizing the Pages Router with internationalization i18n configured and middleware or proxy-based authorization are susceptible to unauthorized access. A remote attacker can exploit this by making locale-less /next/data//.json requests, which bypass the...

7.5CVSS5.7AI score0.00606EPSS
SaveExploits1References4
Snyk
Snyk
added 2026/06/02 10:22 p.m.14 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the serialization algorithm in the PrefetchPageLinks function. An attacker can cause a denial of service by supplying specially crafted user input that is reflected and processed...

8.7CVSS5.5AI score0.00294EPSS
SaveExploits0References2
vulnersOsv
vulnersOsv
added 2026/06/02 10:22 p.m.12 views

@accounter/client (>=0.0.3 <=0.0.11-alpha-20260404002702-9340365def1af08a5cdbbf734a87d1d4839bdaff), @asamanvay/auth-service (>=0.0.2 <=0.0.4) +122 more potentially affected by CVE-2026-34077 via react-router (>=7.0.0 <=7.14.0-pre.0)

react-router NPM version =7.0.0, =0.0.3, =0.0.2, =3.5.2, =1.1.0, =1.0.1-MON-198808-web-js-deps-batch-1.0, =0.0.1, =3.4.9, =0.1.9, =1.27.1, =1.27.1, =0.3.1, =7.13.1-depup.0, =7.13.2-depup.0 and more Source cves: CVE-2026-34077 Source advisory: SNYK:JS-REACTROUTER-17138883...

7.5CVSS5.7AI score0.00294EPSS
SaveExploits0
Snyk
Snyk
added 2026/06/02 10:22 p.m.7 views

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect when certain URLs with path values starting with // are processed. An attacker can redirect users to external domains by supplying specially crafted protocol-relative URLs. Note: Users that utilise Declarative Mode are not...

8.7CVSS5.9AI score0.00162EPSS
SaveExploits0References2
vulnersOsv
vulnersOsv
added 2026/06/02 10:22 p.m.6 views

@accounter/client (>=0.0.3 <=0.0.12-alpha-20260421081155-bb6cc4c0b0b59fff41df172e2f4212eca6906193), @appigram/react-code-split-ssr (=1.3.7) +128 more potentially affected by CVE-2026-40181 via react-router (>=7.0.0 <=7.14.0)

react-router NPM version =7.0.0, =0.0.3, =0.0.2, =3.5.2, =1.1.0, =1.0.1-MON-198808-web-js-deps-batch-1.0, =0.0.1, =3.4.9, =0.1.9, =1.27.1, =1.27.1, =0.3.1, =0.5.1 and more Source cves: CVE-2026-40181 Source advisory: SNYK:JS-REACTROUTER-17138887...

8.7CVSS5.7AI score0.00162EPSS
SaveExploits0
Snyk
Snyk
added 2026/06/02 10:22 p.m.16 views

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect when certain URLs with path values starting with // are processed. An attacker can redirect users to external domains by supplying specially crafted protocol-relative URLs. Note: Users that utilise Declarative Mode are not...

8.7CVSS5.4AI score0.00162EPSS
SaveExploits0References2
vulnersOsv
vulnersOsv
added 2026/06/02 10:22 p.m.7 views

@accounter/client (>=0.0.3 <=0.0.12-alpha-20260508071110-20f5becdec9522d09c6a97f123f7c572407661fb), @appigram/react-code-split-ssr (>=1.3.7 <=1.3.8) +229 more potentially affected by CVE-2026-42342 via react-router (>=7.0.0 <=7.14.2)

react-router NPM version =7.0.0, =0.0.3, =1.3.7, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2, =3.5.2, =1.1.0, =1.0.1-MON-198808-web-js-deps-batch-1.0, =0.0.1, =1.1.0 and more Source cves: CVE-2026-42342 Source advisory: SNYK:JS-REACTROUTER-17138701...

7.5CVSS5.7AI score0.00299EPSS
SaveExploits0
Snyk
Snyk
added 2026/06/02 10:22 p.m.14 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the manifest endpoint. An attacker can exhaust server resources and cause service disruption by sending specially crafted requests that trigger unbounded path expansion. Note:...

8.7CVSS5.5AI score0.00299EPSS
SaveExploits0References2
vulnersOsv
vulnersOsv
added 2026/06/02 10:22 p.m.8 views

@accounter/client (>=0.0.3 <=0.0.12-alpha-20260427054851-6925deba4595cf0c72d3875df0a094608b394a27), @appigram/react-code-split-ssr (=1.3.7) +130 more potentially affected by CVE-2026-42211 via react-router (>=7.0.0 <=7.14.1)

react-router NPM version =7.0.0, =0.0.3, =0.0.2, =3.5.2, =1.1.0, =1.0.1-MON-198808-web-js-deps-batch-1.0, =0.0.1, =3.4.9, =0.1.9, =1.27.1, =1.27.1, =0.3.1, =0.5.1 and more Source cves: CVE-2026-42211 Source advisory: SNYK:JS-REACTROUTER-17137394...

8.1CVSS5.7AI score0.00416EPSS
SaveExploits0
Snyk
Snyk
added 2026/06/02 10:22 p.m.12 views

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the turbo-stream component in in Framework Mode. An attacker can execute arbitrary code on the remote server by sending specially crafted external requests that exploit an existing prototype polluti...

9.2CVSS6.1AI score0.00416EPSS
SaveExploits0References2
RedhatCVE
RedhatCVE
added 2026/06/02 10:2 p.m.19 views

CVE-2026-5509

An authenticated command injection vulnerability exists in the Archer BE450 v1 and BE7200 v1 router that allows an administrator to execute arbitrary system commands through the web management interface. After successfully authenticating to the admin interface, an attacker can leverage the...

8.5CVSS6.2AI score0.02458EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2026/06/02 10:2 p.m.19 views

CVE-2026-45632

Dokploy is a free, self-hostable Platform as a Service PaaS. In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging to other organizations if they know the scheduleId/serverId...

9.9CVSS6AI score0.00256EPSS
SaveExploits0References1
Rows per page
Query Builder