CVE-2026-12495: Stack-based Buffer Overflow

Denial-of-service DoS vulnerability due to a stack buffer overflow in the httpgdprdecrypt function of the Mercusys MB115-4G device's web interface. An unauthenticated attacker could exploit this vulnerability by sending a specially crafted request to the /cgi/login endpoint, causing memory...

Exploit for Missing Authentication for Critical Function in Cpanel

CVE-2026-41940 — cPanel & WHM Authentication Bypass CVSS v3...

Exploit for OS Command Injection in Php

CVE-2024-4577 - PHP CGI Argument Injection on Windows "WorstF...

Oracle Linux 8 : httpd:2.4 (ELSA-2026-42828)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-42828 advisory. - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 -...

Exploit for Command Injection in Php

Vulnerability Assessment and OSINT: CVE-2012-1823 My reposito...

CVE-2026-16448

The CVE-2026-16448 entry applies to D-Link DNS-series devices (e.g., DNS-120, DNS-320/325/327L, DNS-1550-04, etc.) up to 20260205. The affected element is function cgi_check_rsync_rw in /cgi-bin/remote_backup.cgi. Manipulating the ip argument results in a remote command injection, enabling remote...

CVE-2026-16448 D-Link DNS-1550-04 remote_backup.cgi cgi_check_rsync_rw command injection

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...

CVE-2026-16448: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...

Amazon Linux 2 : perl-CGI-Session, --advisory ALAS2-2026-3805 (ALAS-2026-3805)

The version of perl-CGI-Session installed on the remote host is prior to 4.35-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3805 advisory. CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. The...

Updated perl-CGI-Session package fixes a security vulnerability

The updated package fixes a security vulnerability: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. CVE-2026-56016...

MGASA-2026-0286 Updated perl-CGI-Session package fixes a security vulnerability

The updated package fixes a security vulnerability: CGI::Session::ID::md5 versions before 4.49 for Perl generate predictable session ids from low-entropy sources. CVE-2026-56016...

CVE-2026-55629

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMPFILESPATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename...

CVE-2026-55629: Improper Limitation of a Pathname to a Restricted Directory

Whistle is an HTTP, HTTP2, HTTPS, and WebSocket debugging proxy. Prior to 2.10.3, lib/service/service.js handles GET /cgi-bin/temp/get by reading req.query.filename, joining it to TEMPFILESPATH only when it matches the temporary file pattern, and otherwise passing the user-supplied filename...

CVE-2026-62947

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62947

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62947 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62947 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

CVE-2026-62947 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

EUVD-2026-44756

OpenWrt is a Linux operating system targeting embedded devices. Prior to 25.12.5, the cgi-download handler in cgi-io authorizes the requested path against the caller's ubus session file ACL before canonicalization, and rpcd session.c uses fnmatch without FNMPATHNAME, allowing traversal such as an...

PT-2026-60303

Name of the Vulnerable Software and Affected Versions Tenda AC10 v3 version V03.03.16.09 Description A buffer overflow allows attackers to cause a permanent Denial of Service DoS or potentially execute remote code. This issue occurs via the '/cgi-bin/UploadCfg' endpoint. There have been reports o...