CVE-2026-94089

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfaauthentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed...

CVE-2026-94089 D-Link DIR-868L Authentication webfa_authentication.cgi strcpy stack-based overflow

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfaauthentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed...

CVE-2026-94089: Stack-based Buffer Overflow

A vulnerability was determined in D-Link DIR-868L 2.01b05. This issue affects the function strcpy of the file /webfaauthentication.cgi of the component Authentication Handler. Executing a manipulation of the argument id/password can lead to stack-based buffer overflow. The attack can be executed...

PT-2026-95974

Name of the Vulnerable Software and Affected Versions D-Link DIR-868L version 2.01b05 Description A stack-based buffer overflow exists in the Authentication Handler component within the /webfa authentication.cgi endpoint. The issue occurs when the strcpy function processes the id and password...

Astra Linux – Vulnerability in Python 2.7, Pypy

In Python versions 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an HTTP server can perform Regular Expression Denial of Service ReDoS attacks against clients due to the use of urllib.request.AbstractBasicAuthHandler, which allows catastrophi...

CVE-2026-82555

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function loginAuth of the file /webcste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack...

EUVD-2026-68277

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function loginAuth of the file /webcste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack...

CVE-2026-82555 TOTOLINK N600R Authentication cstecgi.cgi loginAuth random values

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function loginAuth of the file /webcste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack...

CVE-2026-82555

CVE-2026-82555 affects the TOTOLINK N600R router (firmware 4.3.0cu.7866_B20220506 ). The vulnerability resides in the loginAuth function of /web_cste/cgi-bin/cstecgi.cgi (Authentication Handler component) and is caused by insufficiently random values , leading to predictable authentication tokens...

CVE-2026-82555: Use of Insufficiently Random Values

A vulnerability has been found in TOTOLINK N600R 4.3.0cu.7866B20220506. This vulnerability affects the function loginAuth of the file /webcste/cgi-bin/cstecgi.cgi of the component Authentication Handler. Such manipulation leads to insufficiently random values. It is possible to launch the attack...

PT-2026-83622

Name of the Vulnerable Software and Affected Versions TOTOLINK N600R version 4.3.0cu.7866 B20220506 Description An issue exists in the Authentication Handler component where the loginAuth function within the '/web cste/cgi-bin/cstecgi.cgi' endpoint uses insufficiently random values. This weakness...

CVE-2026-63770: Use of Less Trusted Source

Glance through 0.8.5 contains an IP address spoofing vulnerability in the authentication handler that allows unauthenticated attackers to bypass brute-force lockout protections by supplying arbitrary values in the X-Forwarded-For request header when the server proxied option is enabled. Attackers...

CVE-2026-11500

A vulnerability was identified in Weaviate up to 1.37.7. This vulnerability affects the function validateConfig of the file usecases/auth/authentication/apikey/client.go of the component Static API Key Handler. The manipulation of the argument StaticApiKey leads to authorization bypass. It is...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the improper validation of the audience parameter in the OIDC authentication process. An attacker can gain unauthorized publish permissions by replaying a valid GitHub OIDC token obtained from one...

Improper Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions in the token revocation process. An attacker can maintain unauthorized access by using a stolen access token that was issued with no expiration, as the token cannot be invalidated through...

GHSA-F5V4-2WR6-HQMG russh has pre-auth DoS via unbounded allocation in its keyboard-interactive auth handler

Summary A pre-authentication denial-of-service vulnerability exists in the server's keyboard-interactive authentication handler. A malicious client can crash any russh-based server that implements keyboard-interactive auth e.g., for 2FA/TOTP with a single malformed packet, requiring no credential...

GHSA-3JP4-MHH4-GCGR Kimai has an Open Redirect via Unvalidated RelayState in SAML ACS Handler

Summary The SAML authentication success handler in Kimai returns the RelayState POST parameter as a redirect destination without validating the host or scheme. After a user successfully authenticates via SAML, they are redirected to an attacker-controlled URL if the IdP includes a malicious...

CVE-2026-4823

A flaw has been found in Enter Software Iperius Backup up to 8.7.3. Affected by this vulnerability is an unknown functionality of the component NTLM2 Handler. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. Attacks of this nature are highl...

Iperius Backup 访问控制错误漏洞

Iperius Backup is a backup tool developed by the Italian company Iperius Backup. Iperius Backup versions 8.7.3 and earlier contained an access control vulnerability, which was caused by improper handling of the NTLM2 Handler component, potentially leading to information leakage...

CVE-2025-70231

The D-Link DIR-513 running firmware version 1.10 is susceptible to a critical path traversal vulnerability. The issue occurs because the system fails to adequately filter the FILECODE parameter when processing POST requests to the /goform/formLogin endpoint, which subsequently calls the /goform/g...