24 matches found
CVE-2026-75775
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router...
EUVD-2026-108610
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router...
CVE-2026-75775
Certain ASUS routers are vulnerable to an OS command injection vulnerability (CWE-78) due to improper neutralization of special elements used in an OS command. A remote user can execute arbitrary commands with root privileges by sending crafted parameters to the router, specifically when the devi...
CVE-2026-75775
Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute arbitrary commands with root privileges via crafted parameters sent to the router while the device is in its factory-default state.Refer to the ' Security Update for ASUS Router...
PT-2026-121781
Name of the Vulnerable Software and Affected Versions ASUS routers affected versions not specified Description Improper neutralization of special elements used in an OS command allows a remote user to execute arbitrary commands with root privileges. This occurs when crafted parameters are sent to...
SUSE CVE-2026-68465
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...
UBUNTU-CVE-2026-68465
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...
CVE-2026-68465
The CVE concerns the Linux kernel MMC subsystem (sdhci-esdhc-imx). The root cause was esdhc_change_pinstate() evaluating pins_100mhz/pins_200mhz at the top and returning -EINVAL if either is undefined, which could prevent the default pin configuration from being restored for devices with a sleep ...
CVE-2026-68465 mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...
CVE-2026-68465: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-esdhc-imx: fix esdhcchangepinstate to allow default state restore esdhcchangepinstate checks for pins100mhz and pins200mhz at the top of the function and returns -EINVAL if either is not defined. This prevents the...
PT-2026-72177
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sdhci-esdhc-imx driver where the esdhc change pinstate function incorrectly validates pins 100mhz and pins 200mhz at the start of the function. By returning -EINVA...
CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time which is leaked via t...
CVE-2026-9733
The Mojolicious::Plugin::Web::Auth::OAuth2 module for Perl (versions through 0.17 ) contains an insecure default state parameter . When no state generator is specified in the constructor, the module generates a SHA-1 hash using predictable, low-entropy sources, including the epoch time (leaked vi...
CVE-2026-9733 Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time which is leaked via t...
PT-2026-51481
Mojolicious::Plugin::Web::Auth::OAuth2 versions through 0.17 for Perl have an insecure default state parameter. When no state generator is specified in the constructor, the module defaults to using a SHA-1 hash of predictable and low-entropy sources, including the epoch time which is leaked via t...
EUVD-2026-38339
A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially...
CVE-2026-11834 Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers
A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially...
CVE-2026-11834 Unauthenticated Command Injection via DHCP Option Handling in Multiple TP-Link Routers
A command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially...
CVE-2026-46049
CVE-2026-46049 concerns the Linux kernel ALSA ctxfi driver (S/PDIF path). The issue arises in spdif_passthru_playback_setup() when pll_rate is not updated (remains 0), causing the MSR calculation loop to spin if 32000 Hz is skipped. The fix adds a fallback: if atc->pll_rate is 0, use atc->r...
CVE-2025-59460
The system is deployed in its default state, with configuration settings that do not comply with the latest best practices for restricting access. This increases the risk of unauthorised connections...