EUVD-2026-35028

A vulnerability was found in Tenda HG7HG9 and HG10 300001138enxpon. Affected by this issue is the function aspvoipOtherSet of the file /boaform/voipotherset of the component Web Management Interface. Performing a manipulation of the argument funckeytransfer results in stack-based buffer overflow...

kernel: wifi: brcmfmac: validate bsscfg indices in IF events

A flaw was found in the Linux kernel's brcmfmac Wi-Fi driver. This vulnerability occurs because the driver fails to properly validate bsscfg indices in interface IF events. An attacker could exploit this by sending a specially crafted IF event with an invalid bsscfg index, which could lead to an...

bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation

A flaw was found in BIND. A remote attacker can exploit this vulnerability by sending maliciously-constructed packets to BIND servers configured for TKEY-based authentication via GSS-API Generic Security Service Application Program Interface tokens. This can lead to excessive memory consumption,...

EUVD-2026-34996

A security flaw has been discovered in songquanpeng one-api up to 0.6.11-preview.7. Affected by this issue is the function Redeem of the file model/redemption.go of the component Redemption Code Top-Up Endpoint. The manipulation results in business logic errors. The attack may be launched remotel...

PT-2026-47559

Summary An authorization issue in the Scheduler API allowed authenticated non-admin users to create or modify scheduled actions that should be restricted to administrators. Details The Scheduler API did not correctly enforce administrator permissions when processing scheduler modifications. As a...

PT-2026-47442

Name of the Vulnerable Software and Affected Versions Archer MR600 v5 Description Command injection occurs in the WireGuard client configuration within the web management interface due to improper neutralization of user-controlled input. An authenticated attacker with administrative privileges ca...

Mozilla Firefox Preview Phishing

The vulnerability of the preview interface for Mozilla Firefox links is related to errors in information presentation by the user interface. Exploiting this vulnerability can allow attackers, operating remotely, to carry out phishing attacks...

FortiSOAR Unauthorized Access

The vulnerability of the graphical user interface of the software solution for coordinating the operation of cybersecurity systems and for managing real-time incident responses in Fortinet FortiSOAR is related to insufficient validation of requests on the server side. Exploiting this vulnerabilit...

DevTools Component UI Replacement

The vulnerability of the DevTools component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a malicious actor to replace the user interface using a specially created Chrome extension...

Media component UI Replacement

The vulnerability of the Media component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a malicious actor to replace the user interface with a specially created HTML page...

LibreChat DoS

The vulnerability of the LibreChat artificial intelligence-based platform is related to an error in processing exceptional states at the final endpoint /api/convos. Exploiting this vulnerability could allow a malicious actor to cause service failures...

TabGroups Component UI Replacement

The vulnerability of the TabGroups component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow a remote attacker to replace the user’s interface...

WebApp Component UI Replacement

The vulnerability of the WebApp component of Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability could allow a malicious actor to replace the user interface with a specially created HTML page...

Google Chrome Microsoft Edge Code Execution

The vulnerability of the user interface of Google Chrome and Microsoft Edge is related to improper handling of code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code using a specially created HTML page...

CVE-2026-8913: Improper Neutralization of Special Elements used in an OS Command

A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when...

TP-Link Archer MR600: Operating System Command Injection Vulnerability

The TP-Link Archer MR600 is a wireless router produced by TP-Link Corporation. The TP-Link Archer MR600 v5 version has a vulnerability related to operating system command injection. This vulnerability stems from improper handling of user-controlled inputs in the web management interface, leading ...

PT-2026-47437

Name of the Vulnerable Software and Affected Versions Tenda F451 versions 1.0.0.7 through 1.0.0.9 Description A security flaw in the Web Management Interface allows remote exploitation via OS command injection. The issue exists within the formWriteFacMac function located in the /goform/WriteFacMa...

CVE-2026-11498: Stack-based Buffer Overflow

A vulnerability was found in Tenda HG7, HG9 and HG10 300001138enxpon. Affected by this issue is the function aspvoipOtherSet of the file /boaform/voipotherset of the component Web Management Interface. Performing a manipulation of the argument funckeytransfer results in stack-based buffer overflo...

PT-2026-47622

Name of the Vulnerable Software and Affected Versions nebula-mesh versions prior to 0.3.2 Description The web UI lacks Cross-Site Request Forgery CSRF protection on all /ui/ routes using POST, PUT, PATCH, or DELETE methods. The application processes requests immediately upon session cookie...

PT-2026-47618

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.2 Description An authorization bypass exists in the Scheduler API where the system fails to consistently enforce administrator permissions. An authenticated non-admin operator can create or modify deviceActions that...