PT-2026-76795

🚨 CVE-2026-67967 Buffer Overflow vulnerability in Tenda W20E V16.01.0.62782 allows an attacker to execute arbitrary code. This is an incomplete fix for CVE-2025-44867 and CVE-2026-36819 🎖@cveNotify...

PT-2026-73202

A vulnerability was detected in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This issue affects some unknown processing of the file /usr/bin/gl nas sys of the component NAS Command Service. The manipulation results in os command injection. The attack may be...

MiracleLinux 9 : hplip-3.21.2-6.el9_8.5.ML.1 (AXSA:2026-1545:04)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1545:04 advisory. HPLIP: Incomplete Fix for CVE-2026-8631 CVE-2026-14544 Tenable has extracted the preceding description block directly from the MiracleLinux security advisory...

sccache-0.17.0~1-2.1 on GA media (moderate)

sccache-0.17.01-2.1 on GA media Announcement ID: openSUSE-SU-2026:11527-1 Rating: moderate Cross-References: CVE-2026-25541 CVE-2026-66746 CVE-2026-66754 CVE-2026-67181 CVE-2026-67182 CVSS scores: CVE-2026-25541 SUSE : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVE-2026-25541 SUSE : 8.7...

CVE-2026-67967

A stack-based buffer overflow and command injection vulnerability exists in the Tenda W20E V5.0 wireless router running firmware US_W20EV5.0qu_V16.01.0.6(2782)_CN&EN_TDE01.bin. The flaw occurs in the /goform/module API, where the setDhcpStaticBindList.bindMACAddr handler uses strcpy() without len...

MINI-2X84-H83P-C75C

Bulletin has no description...

MINI-J3JQ-W7RX-5XFR

Bulletin has no description...

ROOT-APP-NPM-CVE-2026-4923 CVE-2026-4923 in path-to-regexp - Patched by Root

Root has patched CVE-2026-4923 in the path-to-regexp package for Root:npm. Multiple fixed versions available...

CVE-2026-19927 OpenBoxes Product Upload Endpoint ProductController.groovy upload server-side request forgery

A vulnerability was found in OpenBoxes up to 0.9.7. The impacted element is the function Upload of the file grails-app/controllers/org/pih/warehouse/product/ProductController.groovy of the component Product Upload Endpoint. Performing a manipulation of the argument params.url results in server-si...

MINI-2254-QWRH-VWJG

Bulletin has no description...

CVE-2026-19926

CVE-2026-19926 affects Evergreen up to versions 3.14.11/3.15.11/3.16.5/3.17-beta1. The issue lies in an unknown function of the /osrf-gateway-v1 file of the OpenSRF Service (open-ils.fielder), allowing SQL injection through manipulation of that element. The vulnerability can be exploited remotely...

PT-2026-73072

Name of the Vulnerable Software and Affected Versions Evergreen versions prior to 3.14.12 Evergreen versions prior to 3.15.12 Evergreen versions prior to 3.16.6 Evergreen versions prior to 3.17-beta2 Description A remote SQL injection exists within the open-ils.fielder OpenSRF Service, specifical...

MINI-FQF6-HQW5-5VJM

Bulletin has no description...

MINI-HWC4-M8C9-HHF8

Bulletin has no description...

CVE-2026-19474

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-18165 @fastify/oauth2 vulnerable to Login CSRF via plantable OAuth state cookies

@fastify/oauth2 is an OAuth 2.0 plugin for Fastify. In versions from 7.2.0 up to but not including 8.3.0, the plugin validates the OAuth state, and with PKCE the code verifier, by comparing the callback query parameter against an unprefixed, predictable cookie, with no server-side binding to the...

CVE-2026-19474 @fastify/multipart vulnerable to Denial of Service via temporary file leak on aborted upload

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

CVE-2026-19474

The CVE-2026-19474 entry concerns @fastify/multipart, affecting versions 3.0.0 up to but not including 10.1.1. The root cause is that request.saveRequestFiles() can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts; the iterato...

CVE-2026-19474

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...

EUVD-2026-59761

@fastify/multipart is a multipart form-data parser for Fastify. In versions from 3.0.0 up to but not including 10.1.1, request.saveRequestFiles can leave completed temporary files on disk when a client disconnects while the parser is advancing between multipart parts. The iterator rejection that...