TP-Link TL-WR850N 安全漏洞

The TP-Link TL-WR850N is a WiFi router produced by the TP-Link company. The TP-Link TL-WR850N v3 has a security vulnerability. This vulnerability arises from the fact that, when the serial interface is enabled and under weak authentication protection, management credentials and Wi-Fi credentials...

PT-2026-28221

The installer of RATOC RAID Monitoring Manager for Windows searches the current directory to load certain DLLs. If a user is directed to place a crafted DLL with the installer, an arbitrary code may be executed with the administrator privilege...

MailEnable StartDate Parameter Cross-Site Scripting Vulnerability

MailEnable is a Windows-based business email server. A cross-site scripting vulnerability exists in the MailEnable StartDate parameter, which stems from improper cleanup of the StartDate parameter in the FreeBusy.aspx form in the Webmail interface, and can be exploited by an attacker to execute...

Lychee 代码问题漏洞

Lychee is a beautiful and easy-to-use photo management system developed by The Lychee Organisation. It is used for managing and sharing photos. Versions of Lychee prior to 7.5.1 had code vulnerabilities; these vulnerabilities stemmed from incomplete IP verification checks, which failed to prevent...

The vulnerability of the `init_bios_attributes()` function in the drivers/platform/x86/dell/dell-wmi-sysman/sysman.c driver for X86 kernel-based Linux devices allows a hacker to cause a service failure.

The vulnerability of the initbiosattributes function in the drivers/platform/x86/dell/dell-wmi-sysman/sysman.c file of the Linux kernel device driver for X86 processors is related to errors during link update. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the cifs_mount() function in the fs/cifs/connect.c module of the Linux kernel file system allows a hacker to cause a service failure.

The vulnerability of the cifsmount function in the fs/cifs/connect.c module of the Linux kernel file system is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to cause a service failure...

PT-2026-28644

Name of the Vulnerable Software and Affected Versions TL-WR850N version 3 Description The issue allows for the storage of administrative and Wi-Fi credentials in cleartext within a region of the device’s flash memory. The serial interface remains enabled and is protected by weak authentication. A...

PT-2026-28492

Name of the Vulnerable Software and Affected Versions Lychee versions prior to 7.5.1 Description Lychee is a free, open-source photo-management tool. A flaw exists in the IP validation check within the patch for an SSRF issue related to Photo::fromUrl. This incomplete check fails to block loopbac...

PT-2026-28550

Name of the Vulnerable Software and Affected Versions Statamic versions prior to 5.73.16 Statamic versions prior to 6.7.2 Description The user:reset password form tag does not properly escape user-supplied input before rendering it as HTML, potentially allowing an attacker to inject and execute...

CVE-2026-1262

creationtimestamp| type| source ---|---|--- 2026-03-25 23:59:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwcc7hhxc2i...

CVE-2026-32531

creationtimestamp| type| source ---|---|--- 2026-03-25 22:00:52+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw3neikhf2x 2026-03-25 22:20:11+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw4pp7xw52t...

CVE-2026-1001

creationtimestamp| type| source ---|---|--- 2026-03-25 21:49:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhw2zrrx5k2q 2026-06-23 08:23:37+00:00| seen| https://gist.github.com/zanetworker/1c2f8d6638917ee25ed7da3865900455...

CVE-2026-30976

creationtimestamp| type| source ---|---|--- 2026-03-25 21:41:04+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw2jx7i3w2m 2026-03-26 00:12:27+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhwcyordci2n 2026-03-30 19:20:09+00:00| seen|...

CVE-2026-1715

creationtimestamp| type| source ---|---|--- 2026-03-25 21:40:09+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mhw2idsajd2u...

CVE-2025-70887

creationtimestamp| type| source ---|---|--- 2026-03-25 21:36:51+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhw2cgv25t2t...

CVE-2025-70952

creationtimestamp| type| source ---|---|--- 2026-03-25 21:33:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhw24htm3r2d...

CVE-2026-25366

creationtimestamp| type| source ---|---|--- 2026-03-25 21:21:45+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhvzhhi27k22 2026-03-25 23:00:59+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mhw6yuq45l27 2026-03-26 07:56:51+00:00| seen|...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the Delete process. An attacker can remove link shares from projects they do not own by specifying a valid share ID and a project ID for which they have admin rights. Remediation...

GHSA-F95F-77JX-FCJC Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

Summary The DELETE /api/v1/projects/:project/shares/:share endpoint does not verify that the link share belongs to the project specified in the URL. An attacker with admin access to any project can delete link shares from other projects by providing their own project ID combined with the target...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the Delete process. An attacker can remove link shares from projects they do not own by specifying a valid share ID and a project ID for which they have admin rights. Remediation...