CVE-2026-71958

The CVE-2026-71958 entry concerns D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044). The vulnerability is a buffer overflow in the quicksetup.cgi interface. An unauthenticated remote attacker can supply oversized inputs to the test4, ssid2, and username fields to cause...

CVE-2026-71957

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist.name field and execute arbitrary commands by crafting a specific...

CVE-2026-71957

D-Link DWR-M961 devices (hardware version C1, software 1.1.2_C1_202602110044) contain a buffer overflow in the app.cgi interface. A remote attacker can write an overly long string to netAcc.addlist[].name to execute arbitrary commands or crash the device. Root cause: improper input handling in ap...

EUVD-2026-54808

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileg...

CVE-2026-71955

CVE-2026-71955 affects D-Link DWR-M961 devices (hardware version C1). Multiple sources show a command-injection vulnerability in the /boafrm/formWsc interface that allows a remote attacker to inject arbitrary commands via the localPin field, leading to root-level command execution. Affected firmw...

EUVD-2026-54806

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in...

EUVD-2026-54805

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with...

CVE-2026-71951

D-Link DWR‑M961 devices with hardware version C1 and firmware prior to 1.1.5_C1_202607071108 are affected by a remote command‑injection in the /boafrm/formIMEISetup interface. The vulnerability allows an attacker to inject commands via the IMEI_value field, resulting in command execution with roo...

CVE-2026-71948

Affected product/versions: D-Link DWR-M961, hardware version C1, firmware before 1.1.5_C1_202607071108. Vulnerability: command injection via the /boafrm/formDebugDiagnosticRun interface; remote attacker can inject arbitrary commands into the host field, leading to root-level command execution. Im...

CVE-2026-71946 D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-71945

CVE-2026-71945 affects D-Link DWR-M961 devices with hardware version C1 and firmware before 1.1.5_C1_202607071108. The vulnerability is a command injection in the /boafrm/formLtefotaUpgradeFibocom interface, allowing a remote attacker to inject arbitrary commands into the fota_url field, resultin...

MINI-P485-XMR5-X7PP

Bulletin has no description...

MINI-RRJ6-5CPC-XMC3

Bulletin has no description...

MINI-QF9W-32G5-CJM9

Bulletin has no description...

PT-2026-69193

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The decode lockers function in cls lock client.c contains two unsafe decode operations that allow a malicious or compromised Object Storage Device OSD to trigger slab-out-of-bounds reads...

CVE-2026-66061

CVE-2026-66061 affects the Home Assistant project via its iOS Companion app. The root cause is that, prior to version 2026.5.0, tag links (NFC or QR) delivered through OS-level routing (e.g., iOS universal links) could be treated as if physically scanned without validating the calling app or prom...

CVE-2026-9030 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...

EUVD-2026-54655

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...

CVE-2026-46358

OpenBao CVE-2026-46358 affects the OpenBao identity-based secrets management system. Before v2.5.4, its inline auth feature redacted audit-log entries incorrectly, leaving non-auth headers removed while auth-related headers remained in cleartext. This requires local access to the audit device to ...

CVE-2026-11425

Domoticz Mobile Dashboard (versions before 2026.3) is affected by a stored XSS via Text/Alert device rendering. An authenticated attacker can update Text or Alert device values through the API to inject HTML/JavaScript, which is then rendered by ng-bind-html without proper escaping. This can exec...