CVE-2026-7125

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command injection. The attack may be initiated remotely. T...

EUVD-2026-25843

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. Affected by this issue is the function setWiFiEasyCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. The manipulation of the argument merge leads to os command injection. The attack may be initiated remotely. T...

CVE-2026-7122

A vulnerability has been found in Totolink A8000RU 7.1cu.643b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The...

TOTOLINK A8000RU 命令注入漏洞

The TOTOLINK A8000RU is a wireless router produced by TOTOLINK Corporation in China. The Totolink A8000RU 7.1cu.643b20200521 version contains a command injection vulnerability. This vulnerability stems from the setWizardCfg function in the CGI Handler component/cgi-bin/cstecgi.cgi file, which...

TOTOLINK A8000RU 命令注入漏洞

TOTOLINK A8000RU is a wireless router produced by TOTOLINK, a Chinese company. The TOTOLINK A8000RU 7.1cu.643b20200521 version contains a command injection vulnerability. This vulnerability stems from the function setDmzCfg in the CGI Handler component’s file/cgi-bin/cstecgi.cgi, which processes...

TOTOLINK A8000RU 命令注入漏洞

The TOTOLINK A8000RU is a wireless router produced by TOTOLINK Corporation. The Totolink A8000RU 7.1cu.643b20200521 version contains a command injection vulnerability. This vulnerability stems from the setIptvCfg function in the CGI Handler component/cgi-bin/cstecgi.cgi file, which allows for OS...

io.github.tyran8x:tr-common-ai (>=4.0.5.20260423.1, <=4.0.6.20260502.2), org.springframework.ai:spring-ai-starter-vector-store-redis (>=1.1.0-m1, <=1.1.4) potentially affected by CVE-2026-40967 via org.springframework.ai:spring-ai-redis-store (>=1.1.0-m1, <=1.1.4)

org.springframework.ai:spring-ai-redis-store MAVEN version =1.1.0-m1, =4.0.5.20260423.1, =1.1.0-m1, =1.1.4 Source cves: CVE-2026-40967 Source advisory: SNYK:JAVA-ORGSPRINGFRAMEWORKAI-16321395...

BELL-CVE-2026-3890

Bulletin has no description...

BELL-CVE-2026-31672

Bulletin has no description...

BELL-CVE-2026-31638

Bulletin has no description...

almax-common (>=0.10.0, <=1.0.7.dev20240801212517), an-website (>=24.5.0, <=24.10.0) +122 more potentially affected by CVE-2026-41066 via lxml (5.2.2)

lxml PYPI version 5.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on lxml and may be impacted: - almax-common =0.10.0, =24.5.0, =1.0.1, =1.3.29, =0.2.0, =0.0.0, =0.1.2, =0.1.4, =1.6.12, =0.0.1, =0.6.22, =0.2.1, =1.0.4, =1.0.8 - checkout-bot 1.0.0 -...

CVE-2026-41460

creationtimestamp| type| source ---|---|--- 2026-04-23 19:43:06+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk6rhqgrmc2q 2026-04-24 15:21:36+00:00| published-proof-of-concept| Telegram/l8-tUjdZo5KblLOe421TQB8MZuX2H9CaOdWKzaRMJrauLgw 2026-05-31 22:07:08+00:00| seen|...

Exploit for CVE-2026-38751

No d...

freerdp security update

An update is available for freerdp. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released...

BELL-CVE-2026-31525

Bulletin has no description...

DEBIAN-CVE-2026-41989

Libgcrypt before 1.12.2 sometimes allows a heap-based buffer overflow and denial of service via crafted ECDH ciphertext to gcrypkdecrypt...

Linux MPTCP Protocol Heap Buffer Overflow DoS

The vulnerability of the mptcpDestroyCommon and mptcpDestroy functions in the net/mptcp/protocol.c module of the MPTCP protocol implementation in Linux’s kernel is related to a memory leak. Exploiting this vulnerability could allow an attacker to cause a service failure...

@nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading

Summary The queryParentSQL function in the core database package constructs a recursive CTE query by joining nodeIds with string concatenation instead of using parameterized queries. The nodeIds array contains primary key values read from database rows. An attacker who can create a record with a...

DEBIAN-CVE-2026-35330

Bulletin has no description...

Malicious code in @stlm/common-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 524e7ff666da99814e99aa71977173170ff4d7d51c5730a30bf0375665f89582 The package @stlm/common-ui was found to contain malicious code. Source: ghsa-malware 2d6d7ee043c22bf0b8caf216d27b99ca30f22667d60e5d1d0c76178c5808ae5...