CGA-6899-V5V7-96P9

Bulletin has no description...

CVE-2026-82738 Ash.Type.UUIDv7 accepts non-v7 UUIDs that then fail to load, causing persistent denial of service

Improper Input Validation vulnerability in ash-project ash allows an attacker to persistently deny reads of a record by storing a non-version-7 UUID in an Ash.Type.UUIDv7 attribute. Ash.Type.UUIDv7.castinput/2 accepts any well-formed UUID string, including non-version-7 UUIDs, and stores it as a...

CVE-2026-17250

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary...

CVE-2026-17251 Unauthenticated Denial of Service via Null Pointer Dereference in HTTP Request Parsing

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

EUVD-2026-64007

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

CVE-2026-17250 Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary...

CVE-2026-17250 Authenticated Remote Code Execution via Stack-Based Buffer Overflow in Firmware Update Handling

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary...

CVE-2026-17250

A stack-based buffer overflow in the firmware update functionality of the TP-Link TL-MR6400 v7 router allows an authenticated attacker to trigger memory corruption and execute arbitrary code by supplying a crafted firmware image with malicious metadata. The vulnerability is scored CVSS 4.0: 8.5 (...

EUVD-2026-64006

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary...

CVE-2026-17251: NULL Pointer Dereference

A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause...

CVE-2026-17250: Stack-based Buffer Overflow

A stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary...

PT-2026-79405

Name of the Vulnerable Software and Affected Versions TL-MR6400 version v7 Description A stack-based buffer overflow occurs in the firmware update functionality due to the unsafe processing of attacker-controlled metadata within a firmware image. An authenticated attacker can exploit this to...

CVE-2026-17252: Out-of-bounds Write

A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request...

liteyukibot-v7-runtime-astrbot (>=0.1.0a1, <=0.1.0a7) potentially affected by CVE-2026-16073 via astrbot (>=4.27.2, <=4.27.5)

astrbot PYPI version =4.27.2, =0.1.0a1, =0.1.0a7 Source cves: CVE-2026-16073 Source advisory: SNYK:PYTHON-ASTRBOT-18508057...

liteyukibot-v7-runtime-astrbot (>=0.1.0a1, <=0.1.0a7) potentially affected by CVE-2026-15500 via astrbot (>=4.27.2, <=4.27.5)

astrbot PYPI version =4.27.2, =0.1.0a1, =0.1.0a7 Source cves: CVE-2026-15500 Source advisory: SNYK:PYTHON-ASTRBOT-17954638...

liteyukibot-v7-runtime-astrbot (>=0.1.0a1, <=0.1.0a7) potentially affected by CVE-2026-15499 via astrbot (>=4.27.2, <=4.27.5)

astrbot PYPI version =4.27.2, =0.1.0a1, =0.1.0a7 Source cves: CVE-2026-15499 Source advisory: SNYK:PYTHON-ASTRBOT-17954639...

liteyukibot-v7-runtime-astrbot (>=0.1.0a1, <=0.1.0a7) potentially affected by CVE-2026-15501 via astrbot (>=4.27.2, <=4.27.5)

astrbot PYPI version =4.27.2, =0.1.0a1, =0.1.0a7 Source cves: CVE-2026-15501 Source advisory: SNYK:PYTHON-ASTRBOT-17954640...

CVE-2026-56279 Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint

Capgo before 12.128.2 contains an information disclosure vulnerability in the getorgsv7userid RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles,...

CVE-2026-56279 Capgo - Information Disclosure via get_orgs_v7 RPC Endpoint

Capgo before 12.128.2 contains an information disclosure vulnerability in the getorgsv7userid RPC function that remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles,...

CVE-2026-53663: Cross-Site Request Forgery (CSRF)

React Router is a router for React. From 7.12.0 until 7.15.1, certain CSRF checks in React Router v7 Framework Mode were insufficient and run on POST requests, but were bypassed on PUT/PATCH/DELETE requests. This is a low severity vulnerability because modern browser protections CORS preflight,...