CVE-2026-36983

D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub42EF14 of the file /bin/alphapd. The manipulation of the argument LightSensorControl leads to command injection...

D-Link M60 License Issue Vulnerability

The D-Link M60 is a wireless routing device from China-based D-Link. An authorization issue vulnerability exists in D-Link M60 version 1.20B02 and prior versions, which stems from a weak password recovery issue in the file /usr/bin/httpd, and can be exploited by an attacker to cause...

CVE-2026-36983

D-Link DCS-932L v2.18.01 is affected by a Command Injection in the helper function sub_42EF14 of /bin/alphapd. Passing/manipulating the LightSensorControl argument can lead to command execution. CVSSv3.1 base score 7.3 (HIGH); attack vector NETWORK, attack complexity LOW, privileges NONE, user in...

CVE-2026-36983

D-Link DCS-932L v2.18.01 is vulnerable to Command Injection in the function sub42EF14 of the file /bin/alphapd. The manipulation of the argument LightSensorControl leads to command injection...

PT-2026-39868

Name of the Vulnerable Software and Affected Versions D-Link DIR-816 version 1.10CNB05 R1B011D88210 Description A command injection issue exists that allows a remote attacker to execute arbitrary commands. The flaw is located in the sub 445E7C function within the '/goform/singlePortForward'...

PT-2026-39867

Name of the Vulnerable Software and Affected Versions D-Link DIR-816 version 1.10CNB05 R1B011D88210 Description A command injection flaw exists in the /goform/formDMZ.cgi endpoint. The issue is located within the sub 445E7C function, allowing a remote attacker to execute arbitrary commands...

D-Link DNS-320 命令注入漏洞

The D-Link DNS-320 is a NAS Network Attached Storage device produced by D-Link Corporation. The D-Link DNS-320 version 2.06B01 has a command injection vulnerability. This vulnerability arises from functions such as delete, rename, copy, move, chmod, and chown in the file/cgi-bin/webfilemgr.cgi,...

D-Link DCS-932L 安全漏洞

The D-Link DCS-932L is a network surveillance camera from D-Link Corporation. It is used for security and monitoring purposes. The D-Link DCS-932L version 2.18.01 has a security vulnerability. This vulnerability stems from improper handling of the parameter LightSensorControl by the function...

D-Link DNS-320 命令注入漏洞

The D-Link DNS-320 is a NAS Network Attached Storage device produced by D-Link Corporation. The D-Link DNS-320 version 2.06B01 has a command injection vulnerability. This vulnerability stems from functions in the file /cgi-bin/networkmgr.cgi, namely...

PT-2026-39870

A vulnerability was detected in D-Link DIR-816 1.10CNB05 R1B011D88210. This affects the function portForward. Performing a manipulation of the argument ip address results in command injection. The attack can be initiated remotely. The exploit is now public and may be used...

PT-2026-39536

Name of the Vulnerable Software and Affected Versions D-Link DCS-935L versions prior to 1.10.01 Description A remote buffer overflow exists in the HNAP Service component within the '/web/cgi-bin/hnap/hnap service' file. The issue occurs during the processing of the SetDeviceSettings function when...

MGASA-2026-0124 Updated rootcerts, nss & firefox packages fix security vulnerabilities

Use-after-free in the DOM: Core & HTML component. CVE-2026-6746 Use-after-free in the WebRTC component. CVE-2026-6747 Uninitialized memory in the Audio/Video: Web Codecs component. CVE-2026-6748 Information disclosure due to uninitialized memory in the Graphics: Canvas2D component. CVE-2026-6749...

SUSE CVE-2026-43245

In the Linux kernel, the following vulnerability has been resolved: ntfs: -dcompare must not block ... so don't use getname there. Switch it and ntfsdhash, while we are at it to kmallocPATHMAX, GFPNOWAIT. Yes, ntfsdhash almost certainly can do with smaller allocations, but let ntfs folks deal wit...

CVE-2024-43384 Phoenix Contact: Improper removal of sensitive information in MGUARD products

A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues Updated to Mozilla Thunderbird 140.10.1: MFSA 2026-34 bsc1262230: CVE-2026-6746: Use-after-free in the DOM: Core & HTML component. CVE-2026-6747: Use-after-free in the WebRTC component. CVE-2026-6748: Uninitialized memory in the...

PT-2026-45198

Name of the Vulnerable Software and Affected Versions D-Link DI-8400 versions prior to 16.07.26A1 Description A stack-based buffer overflow occurs in an unknown function within the '/dbsrv.asp' endpoint. This issue is triggered by manipulating the str argument, allowing for remote exploitation. A...

CVE-2026-43245

A flaw was found in the Linux kernel's NTFS filesystem driver. The -dcompare function, responsible for comparing directory entries, was found to perform blocking operations. This behavior, along with the misuse of namescachep for memory allocations, could lead to system unresponsiveness or a deni...

CVE-2026-7854

A security vulnerability has been detected in D-Link DI-8100 16.07.26A1. Affected by this vulnerability is the function urlruleasp of the file /urlrule.asp of the component POST Parameter Handler. Such manipulation leads to buffer overflow. It is possible to launch the attack remotely. The exploi...

CVE-2026-43161

A flaw was found in the Linux kernel's Intel IOMMU Input/Output Memory Management Unit virtual technology for directed I/O VT-d subsystem. When a PCIe Peripheral Component Interconnect Express endpoint device, especially when passed through to userspace applications like QEMU or DPDK, unexpectedl...

EUVD-2026-27689

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Flush dev-IOTLB only when PCIe device is accessible in scalable mode Commit 4fc82cd907ac "iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected" relies on pcidevisdisconnected to skip ATS...