D-Link DWR-M961 command injection vulnerability (CNVD-2026-32365)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability stems from the /boafrm/formDebugDiagnostics interface...

PT-2026-70429

Name of the Vulnerable Software and Affected Versions Windows Accessibility Infrastructure ATBroker.exe affected versions not specified Description Improper link resolution before file access, also known as link following, in the Windows Accessibility Infrastructure ATBroker.exe allows an...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32359)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability, which stems from the app.cgi interface not filtering the command separato...

PT-2026-70141

Name of the Vulnerable Software and Affected Versions Friendica versions prior to 2026.08-dev Description An authenticated user with a self-registered account can perform a server-side request forgery SSRF through the link-preview endpoint. This occurs because the endpoint fetches user-supplied...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32362)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM card and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability. This vulnerability stems from the /boafrm/formIMEISetup interface not...

PT-2026-70051

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server ABAP affected versions not specified Description An authenticated attacker can generate and distribute a malicious link. When an authenticated victim accesses this link, injected input is processed and reflecte...

D-Link DWR-M961 command injection vulnerability (CNVD-2026-32363)

The D-Link DWR-M961 is a 4G LTE AC1200 dual-band wireless router launched by D-Link. It supports internet access via SIM cards and wired WAN multi-mode connectivity. The D-Link DWR-M961 has a command injection vulnerability, which stems from the /boafrm/formPinManager interface not filtering the...

CVE-2026-65680: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Microsoft OneDrive allows an authorized attacker to elevate privileges locally...

CVE-2026-62803: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows DHCP Server allows an authorized attacker to elevate privileges locally...

CVE-2026-62807: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows DHCP Server allows an authorized attacker to elevate privileges locally...

CVE-2026-61358: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Accessibility Infrastructure ATBroker.exe allows an authorized attacker to elevate privileges locally...

CVE-2026-62776: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows DHCP Server allows an authorized attacker to elevate privileges locally...

CVE-2026-62761: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows DHCP Server allows an authorized attacker to elevate privileges locally...

CVE-2026-72971: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Container Isolation FS Filter Driver unionfs.sys allows an authorized attacker to perform tampering locally...

CVE-2026-70348: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Management Services allows an authorized attacker to deny service locally...

CVE-2026-72597: Server-Side Request Forgery (SSRF)

A server-side request forgery vulnerability in Friendica through the 2026.08-dev branch allows authenticated users with a free self-registered account to probe internal network services via the link-preview endpoint. The endpoint fetches any user-supplied URL without applying an internal IP deny...

CVE-2026-62812: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows DHCP Server allows an authorized attacker to elevate privileges locally...

Grafana MCP server-side request forgery via X-Grafana-URL header (grafana_api_request)

A caller who can invoke the grafanaapirequest tool can supply an X-Grafana-URL request header to control the destination of mcp-grafana's outbound requests, and can also choose the HTTP method, path, and body. Because the destination isn't restricted to the configured Grafana instance, the caller...

PT-2026-70785

Name of the Vulnerable Software and Affected Versions Dozzle versions 10.5.2 through 10.6.14 Description The isBlockedIP SSRF guard in internal/notification/dispatcher/webhook.go, utilized by safeDialContext for webhook notification URLs, fails to inspect IPv4 addresses embedded within 6to4, NAT6...

CVE-2026-62832: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows User Profile Service allows an authorized attacker to elevate privileges locally...