CVE-2026-7538 Totolink A8000RU CGI cstecgi.cgi vulnerability os command injection

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. This issue affects the function Vulnerability of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument proto leads to os command injection. The attack may be initiated remotely. The explo...

SourceCodester Advanced School Management System 注入漏洞

SourceCodester Advanced School Management System is an advanced school management system developed by SourceCodester as open source. Version 1.0 of the SourceCodester Advanced School Management System has a vulnerability related to SQL injection, which originates from an unknown function in the...

TOTOLINK A8000RU 命令注入漏洞

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A8000RU 7.1cu.643b20200521 version contains a command injection vulnerability. This vulnerability stems from an unknown function in the CGI Handler component file /cgi-bin/cstecgi.cgi, which manipulates th...

CLSA-2026-1777539688 sysstat: Fix of 2 CVEs

CVE-2022-39377: sizet overflow in allocatestructures sacommon.c may cause buffer overflow leading to RCE - CVE-2023-33204: integer overflow in checkoverflow common.c - incomplete fix for CVE-2022-39377...

Open redirect vulnerability in multiple laser printers and MFPs which implement Ricoh Web Image Monitor

Overview Web Image Monitor provided by Ricoh Company, Ltd. is a web server that is included in and runs on laser printers and MFPs multifunction printers. Web Image Monitor contains the vulnerability listed below. Open redirect CWE-601 - CVE-2026-41226 Tony Kirkland of Sixgen Inc reported this...

DEBIAN-CVE-2026-6530

DCP-ETSI protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service...

DEBIAN-CVE-2026-5408

BT-DHT protocol dissector crash in Wireshark 4.6.0 to 4.6.4 and 4.4.0 to 4.4.14 allows denial of service...

CVE-2026-42141

creationtimestamp| type| source ---|---|--- 2026-04-30 07:00:11+00:00| seen| Telegram/P5bUU6aFVi3TImC6WDx24HeHf8RVUggO7fw0-2Q4WCtYm0 2026-04-30 07:02:37+00:00| seen| https://t.me/GithubRedTeam/82154 2026-04-30 09:00:04+00:00| seen| Telegram/yjUnQ6hKYXBxzaCr4Cr42UE0MHqi1VzU3UchLczNxtZwAY...

CVE-2026-7489

creationtimestamp| type| source ---|---|--- 2026-04-30 02:20:00+00:00| seen| https://www.twcert.org.tw/en/cp-139-10895-25ca1-2.html...

Amazon Linux 2023 : xorg-x11-server-common, xorg-x11-server-devel, xorg-x11-server-source (ALAS2023-2026-1614)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1614 advisory. XKB Integer Underflow in XkbSetCompatMap CVE-2026-33999 XKB Out-of-bounds Read in CheckSetGeom CVE-2026-34000 XSYNC Use-after-free in miSyncTriggerFence CVE-2026-34001 XKB Out-of-bounds read i...

Certificate Impersonation

spring-security-web is vulnerable to certificate impersonation. The vulnerability is due to improper parsing of malformed X.509 certificate CN values in SubjectX500PrincipalExtractor, which can result in extracting an incorrect username and allow attackers to impersonate another user...

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0 <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0 <=4.7.4) +1846 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (>=7.0.0 <=7.0.6)

org.springframework:spring-webmvc MAVEN version =7.0.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.7.5 and more Source cves: CVE-2026-22745 Source advisory: OSV:GHSA-6P4F-WCWH-5VVM...

ai.platon.pulsar:pulsar-e2e-tests (>=4.5.0 <=4.6.0), ai.platon.pulsar:pulsar-it-tests (>=4.5.0 <=4.7.4) +1846 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (>=7.0.0 <=7.0.6)

org.springframework:spring-webmvc MAVEN version =7.0.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =4.5.0, =2.0.0, =2.0.0, =0.1.1, =0.2.0, =0.5.0, =0.7.0, =0.5.0, =0.5.0, =0.7.5 and more Source cves: CVE-2026-22741 Source advisory: OSV:GHSA-WG35-8JPF-2XV3...

CVE-2026-6276

creationtimestamp| type| source ---|---|--- 2026-04-29 07:00:59+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mkmjoj7gm52b 2026-04-29 12:45:07+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkn4vufiap2k...

Improper Validation of Specified Quantity in Input

Overview Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input due to improper handling of oversized Subject Alternative Name fields during certificate validation. An attacker can bypass certificate validation by crafting a certificate with an...

EyouCMS 注入漏洞

EyouCMS is an open-source content management system CMS developed by Eyou Corporation in China, based on ThinkPHP. EyouCMS versions 1.7.9 and earlier have a vulnerability related to injection attacks. This vulnerability arises from improper handling of the sortasc parameter in the GetSortData...

Oracle Linux 8 : libxml2 (ELSA-2026-11349)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-11349 advisory. - Fix CVE-2025-9714 RHEL-119279 - Fix CVE-2025-32415 RHEL-100177 - Fix CVE-2025-7425 RHEL-102797 - Fix CVE-2025-6021 RHEL-96498 - Fix CVE-2025-49794 RHEL-96398...

SUSE CVE-2026-31787

In the Linux kernel, the following vulnerability has been resolved: xen/privcmd: fix double free via VMA splitting privcmdvmops defines .close privcmdclose, but neither .maysplit nor .open. When userspace does a partial munmap on a privcmd mapping, the kernel splits the VMA via splitvma. Since...

CVE-2026-40891 vulnerabilities

Vulnerabilities for packages: azure-functions-host, kubernetes-reflector...

CVE-2025-67223

creationtimestamp| type| source ---|---|--- 2026-04-28 09:00:05+00:00| seen| Telegram/dDiaPBuG5063OaJpBdVqzzs7lpwbpzaCXJ5I6hjB4akKrXs 2026-04-28 16:30:36+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mkkz25mvtm2e 2026-04-28 21:00:04+00:00| seen|...