CVE-2026-38527

A Server-Side Request Forgery SSRF in the /settings/webhooks/create component of Webkul Krayin CRM v2.2.x allows attackers to scan internal resources via supplying a crafted POST request...

CVE-2026-38530

A Broken Object-Level Authorization BOLA in the /Controllers/Lead/LeadController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any lead owned by other users via supplying a crafted GET request...

CVE-2026-38529

A Broken Object-Level Authorization BOLA in the /Settings/UserController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily reset user passwords and perform a full account takeover via supplying a crafted HTTP request...

CVE-2026-38532

A Broken Object-Level Authorization BOLA in the /Contact/Persons/PersonController.php endpoint of Webkul Krayin CRM v2.2.x allows authenticated attackers to arbitrarily read, modify, and permanently delete any contact owned by other users via supplying a crafted GET request...

Tenda i3 Wireless Access Point Bypass Access

The vulnerability of function R7WebsSecurityHandler in the Tenda i3 wireless access point software is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to bypass security restrictions and gain unauthorized acce...

FortiOS API Crash

The vulnerability of the application programming interface API of FortiOS operating systems is related to the lack of checking for the return value. Exploiting this vulnerability allows a malicious actor to cause errors in the HTTP daemon by sending a specially crafted request...

D-Link Router Buffer Overflow DoS

The vulnerability of D-Link DI-8003 and DI-8003G router microprogramming software lies in the copying of buffers without checking the size of input data during the processing of the wanping parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a...

GHSA-FPJ4-9QHX-5M6M DNN: Force Friend Request Acceptance

DNN formerly DotNetNuke is an open-source web content management platform CMS in the Microsoft ecosystem. Starting in version 6.0.0 and prior to version 10.2.2, in the friends feature, a user could craft a request that would force the acceptance of a friend request on another user. Version 10.2.2...

CVE-2023-46945

QD 20230821 is vulnerable to Server-side request forgery SSRF via a crafted request...

CVE-2026-5440

A memory exhaustion vulnerability exists in the HTTP server due to unbounded use of the Content-Length header. The server allocates memory directly based on the attacker supplied header value without enforcing an upper limit. A crafted HTTP request containing an extremely large Content-Length val...

CVE-2025-50664

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /usergroup.asp endpoint. The attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, mem, pri, and attr...

CVE-2023-46945

QD 20230821 is vulnerable to Server-side request forgery SSRF via a crafted request...

PT-2026-31371

Name of the Vulnerable Software and Affected Versions D-Link DI-8003 version 16.07.26A1 Description A buffer overflow can occur in D-Link DI-8003 version 16.07.26A1 when the s parameter in the /pppoe list opt.asp API endpoint is manipulated with an excessively large value. This manipulation can...

CVE-2025-50670

The D-Link DI-8003 wireless router (firmware version 16.07.26A1 ) is susceptible to a buffer overflow vulnerability. The root cause is the copying of buffers without adequate bounds checking when processing the name, qq, and time parameters in the /xwgl_bwr.asp endpoint. A remote attacker can exp...

CVE-2025-50664

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of parameters in the /usergroup.asp endpoint. The attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, mem, pri, and attr...

PT-2026-31328

Name of the Vulnerable Software and Affected Versions QD 20230821 affected versions not specified Description QD 20230821 is susceptible to a Server-side request forgery SSRF condition. This occurs when a crafted request is processed, allowing for potential unauthorized access or actions on...

CVE-2023-46945

QD 20230821 is vulnerable to Server-side request forgery SSRF via a crafted request...

PT-2026-31388

Name of the Vulnerable Software and Affected Versions D-Link DI-8003 version 16.07.26A1 Description A buffer overflow exists due to improper handling of input parameters. An attacker can exploit this by sending a crafted HTTP GET request to the /web keyword.asp endpoint using the name, en, time,...

PT-2026-31384

A buffer overflow vulnerability exists in D-Link DI-8003 16.07.26A1 due to improper handling of multiple parameters in the /url rule.asp endpoint. An attacker can exploit this vulnerability by sending a crafted HTTP GET request with parameters name, en, ips, u, time, act, rpri, and log...

CVE-2025-15620

HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an...