75041 matches found
CVE-2026-85676 Dub Open Redirect via Unrestricted redir_url Parameter
Dub contains an open redirect vulnerability in the redirurl query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redirurl parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Du...
CVE-2026-85676
Dub , a link-shortening service, contains an open redirect vulnerability in its redir_url query parameter. The parameter is accepted on every short link without validation or domain-allowlist enforcement, allowing attackers to append an arbitrary external URL and redirect visitors through the tru...
Malicious Package
Overview dajouka-sclas-rc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious Package
Overview cz-conventional-changelog-comet-prompts-link is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...
EUVD-2026-70818
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
EUVD-2026-70766
A vulnerability was found in D-Link DNS-340L 1.01B04. Affected by this issue is some unknown functionality of the file /cgi-bin/dropbox.cgi of the component CGI Handler. Performing a manipulation of the argument callbackurl/syncinterval results in os command injection. The attack can be initiated...
EUVD-2026-70768
A vulnerability was determined in D-Link DNS-320 ShareCenter 2.06B01. This affects an unknown part of the file /cgi/filesharing.cgi of the component File Sharing. Executing a manipulation of the argument fileurl can lead to os command injection. The attack can be launched remotely. The exploit ha...
EUVD-2026-70819
A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...
PT-2026-85671
IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links...
CVE-2026-85676: URL Redirection to Untrusted Site
Dub contains an open redirect vulnerability in the redirurl query parameter that is accepted on every short link without validation or domain allowlist enforcement. Attackers can append the redirurl parameter to any short link to redirect visitors to arbitrary external URLs through the trusted Du...
The vulnerability of the qrtr_port_remove() function in the net/qrtr/af_qrtr.c module, which supports Qualcomm IPC cores in the Linux operating system, allows a hacker to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the qrtrportremove function in the net/qrtr/afqrtr.c module, which supports Qualcomm IPC cores in the Linux operating system, is related to errors during link counter updates. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity,...
CVE-2026-61608: Insufficient Session Expiration
SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, UserInvitation entities have no expiry timestamp. Invitation links mailed to users remain valid indefinitely, meaning a leaked, forwarded, or archived invitation email can be used at any time in the future to join a compan...
The vulnerability of the pppol2tp_ioctl() function in the net/l2tp/l2tp_ppp.c module of the Layer Two Tunneling Protocol (L2TP) implementation in the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the pppol2tpioctl function in the net/l2tp/l2tpppp.c module of the Layer 2 Tunneling Protocol implementation in the Linux operating system is related to errors during link counter updates. Exploiting this vulnerability can allow an attacker to compromise the confidentiality,...
CVE-2026-18167
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
CVE-2026-18330
A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...
CVE-2026-18167 Stack-based buffer overflow in TP-Link Archer AX55 v4
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
CVE-2026-18167
A stack-based buffer overflow in the EasyMesh module of the TP-Link Archer AX55 v4 allows a LAN attacker, when Mesh mode is enabled, to submit crafted input that crashes the easymesh daemon and may potentially achieve remote code execution . The vulnerability requires no prior authentication but ...
CVE-2026-18167 Stack-based buffer overflow in TP-Link Archer AX55 v4
A stack-based buffer overflow vulnerability exists in the EasyMesh module of TP-Link Archer AX55 v4. When Mesh mode is enabled, a LAN attacker may submit crafted input that causes the easymesh daemon to crash and may potentially achieve remote code execution on the device. Successful exploitation...
CVE-2026-18330 Hardcoded Shared RSA-1024 Private Key in TP-Link Archer AX55 v4
A hard-coded cryptographic key vulnerability exists in the web module of TP-Link Archer AX55 v4. A LAN attacker who captures an HTTP login session may use the known shared RSA private key to decrypt the administrator password; the weakened AES session key further reduces the effort required to...
CVE-2026-18330
A hard-coded shared RSA-1024 private key vulnerability exists in the web module of the TP-Link Archer AX55 v4 . A LAN attacker who captures an HTTP login session can use the known shared private key to decrypt the administrator password , and a weakened AES session key further reduces the effort ...