PT-2026-69213

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 versions prior to 1.1.5 C1 202607071108 Description A command injection issue exists in the '/boafrm/formTracerouteDiagnosticRun' endpoint. A remote attacker can inject arbitrary malicious commands through t...

CVE-2026-71951: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formIMEISetup interface. A remote attacker can inject arbitrary malicious commands into the IMEIvalue field, resulting in command execution wit...

PT-2026-69212

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 versions prior to 1.1.5 C1 202607071108 Description A command injection issue exists in the /boafrm/formPingDiagnosticRun endpoint. A remote attacker can inject arbitrary malicious commands through the host...

PT-2026-69222

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 software version 1.1.2 C1 202602110044 Description A command injection issue exists in the 'app.cgi' interface. A remote attacker can inject arbitrary malicious commands through the netDig.ping.dst field,...

CVE-2026-71953: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formNtp interface. A remote attacker can inject arbitrary malicious commands into the ntpServerIp1 field, resulting in command execution with...

PT-2026-69219

Name of the Vulnerable Software and Affected Versions D-Link DWR-M961 hardware version C1 versions prior to 1.1.5 C1 202607071108 Description A command injection issue exists in the '/boafrm/formNtp' endpoint. A remote attacker can inject arbitrary malicious commands through the ntpServerIp1 fiel...

CVE-2026-71955: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2C1202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resultin...

CVE-2026-71952: Improper Neutralization of Special Elements used in an OS Command

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPinManageSetup interface. A remote attacker can inject arbitrary malicious commands into the oldPIn field, resulting in command execution...

CVE-2026-64676

creationtimestamp| type| source ---|---|--- 2026-08-07 22:58:10+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ctob55wdrm6sp...

GHSA-F23P-VX2J-J53R

creationtimestamp| type| source ---|---|--- 2026-08-07 22:31:14+00:00| seen| https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378 2026-08-08 00:01:19+00:00| seen| https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378...

CVE-2026-71850

creationtimestamp| type| source ---|---|--- 2026-08-07 22:31:14+00:00| seen| https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378 2026-08-08 00:01:19+00:00| seen| https://gist.github.com/alon710/6634ad7314d99c5586618c1848016378...

GHSA-5P4M-2WFM-XMQJ

creationtimestamp| type| source ---|---|--- 2026-08-07 22:06:55+00:00| seen| https://gist.github.com/gomesalexandre/8cd74b41b9830109d823dcb777041502 2026-09-03 19:24:03+00:00| seen| https://gist.github.com/konard/05d19a59942ef51514e30abcc55dbc13 2026-09-03 20:23:57+00:00| seen|...

CVE-2025-63235

creationtimestamp| type| source ---|---|--- 2026-08-07 21:51:08+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3msjk2bvxxh2c 2026-08-08 07:01:14+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mskirwemci2y...

CVE-2026-9031 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

An input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web...

CVE-2026-9031

Summary: CVE-2026-9031 is an input validation vulnerability in the HTTP-WRITEOEM handler of the TP-Link Archer A6 web interface. The weakness stems from insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Impact (as documented): Successful ...

CVE-2026-9030 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...

CVE-2026-9030 Authenticated Denial-of-Service in HTTPD Service in TP-Link Archer A6

A denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path,...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...

CVE-2026-59717 Home Assistant Companion: `homeassistant://invite` Deep Link Credential Phishing

Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.6.1, the Android Companion app is vulnerable to an open redirect. The app passes the URL fragment from a homeassistant://invite deep link into the onboarding flow without ever displaying the...