CVE-2026-64176

A flaw was found in the Linux kernel's iwlwifi driver, affecting older Intel wireless devices. This vulnerability arises from incorrect handling of transmit TX rates, specifically when the driver attempts to set these rates. An attacker could potentially trigger a firmware assert or crash, leadin...

CVE-2026-64175

A flaw was found in the Linux kernel's iwlwifi driver. When the Wi-Fi firmware crashes, the driver continues to process network transmission requests inefficiently. This creates a continuous loop of attempting to send data through an unresponsive firmware, consuming excessive CPU resources and...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-6952

A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17ABPC.7.2C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

CVE-2026-16331 D-Link DNS-320 save_ajax.php unrestricted upload

A security vulnerability has been detected in D-Link DNS-320 1.0.2. This affects an unknown function of the file /web/function/saveajax.php. Such manipulation of the argument Malicious Handler leads to unrestricted upload. The attack can be executed remotely. The exploit has been disclosed public...

EUVD-2024-55692

The Tenda TX9 V22.03.02.20 firmware has a denial of service vulnerability in the updatedevname function of the file /goform/SetOnlineDevName...

EUVD-2024-55688

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub42EEE0 function of the file /goform/SetStaticRouteCfg...

EUVD-2024-55691

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub425964 function of the file /goform/SetOnlineDevName...

EUVD-2024-55690

The Tenda TX9 V22.03.02.20 firmware has a stack overflow vulnerability in the sub424CE0 function of the file /goform/setMacFilterCfg...

PT-2026-62107

Trezor Safe 3, Safe 5, and Safe 7 firmware contains a confirmation-binding flaw in the Ethereum sign tx / sign tx eip1559 flow. For contract interactions, the device confirms only the initial calldata chunk while the signature commits to the full streamed calldata. An attacker could present...

PT-2026-62120

Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web...

DD-WRT Stack-Based Buffer Overflow Vulnerability

DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability...

PT-2026-61989

In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability CWE-284 / CWE-862 has been identified in the Direct Device Integration DDI Controller. This vulnerability allows an authenticated device to escalate its permissions and bypass the strict boundaries of its assigned...

PT-2026-62416

Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An unauthenticated attacker can supply crafted input in the url parameter to execute arbitrary operating system commands...

PT-2026-62419

Name of the Vulnerable Software and Affected Versions Autel Maxi Charger Single versions prior to V1.03.52 Description The device exposes an accessible UART Universal Asynchronous Receiver-Transmitter, a hardware communication protocol interface. This allows an attacker with physical access to...

PT-2026-62121

Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multiple management endpoints. An attacker can supply the special token value to invoke privileged functionality without valid authentication...

PT-2026-62415

Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002. A crafted request to the /test endpoint can cause the device to download, extract, and execute attacker-controlled files with root privileges...

PT-2026-62420

Autel Maxi Charger Single firmware through V1.03.51 permits unrestricted access to the NXP i.MX6 recovery mode through exposed hardware recovery pins. An attacker with physical access can boot attacker-controlled code in memory and modify or extract firmware and other sensitive data...