CVE-2026-72001: Authorization Bypass Through User-Controlled Key

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

CVE-2026-82595: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...

CVE-2026-82680: Out-of-bounds Write

A weakness has been identified in D-Link DSM-G600 1.01. This affects an unknown function of the file /loadfile.cgi of the component Multipart Handler. Executing a manipulation can lead to out-of-bounds write. The attack may be launched remotely. The exploit has been made available to the public a...

CVE-2026-82593: Stack-based Buffer Overflow

A flaw has been found in D-Link DIR-825M 1.1.8. This impacts the function sub41802C of the file /boafrm/formLtefotaUpgradeFibocom of the component LTE Module Firmware Upgrade. This manipulation of the argument fotaurl causes stack-based buffer overflow. The attack is possible to be carried out...

CVE-2026-82692: Improper Neutralization of Special Elements used in an OS Command

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsimgr.cgi. Performing a manipulation of the argument alias/username/password/volumelocation results in os command injection. It is possible to initiate the attack remotely...

PT-2026-83954

Name of the Vulnerable Software and Affected Versions Pangolin versions prior to 1.22.0 Description An authentication bypass exists that allows unauthenticated attackers to access protected resources. By providing an attacker-controlled URL parameter to the share-link authentication endpoint, the...

PT-2026-83972

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A memory leak occurs in the net ipv6 send ns function within subsys/net/ip/ipv6 nbr.c when allocating a transmit net pkt for a Neighbor Solicitation. If the...

CVE-2026-82688: Improper Neutralization of Special Elements used in an OS Command

A security vulnerability has been detected in D-Link DNS-340L and DNS-345 1.01B04/1.03B06/1.04.B02/1.05b04. This impacts an unknown function of the file /cgi-bin/virtualvol.cgi of the component Virtual Volume Handler. The manipulation of the argument fsharename/ftarget/fname leads to os command...

PT-2026-83779

Name of the Vulnerable Software and Affected Versions D-Link DNS-340L version 1.01B04 D-Link DNS-340L version 1.03B06 D-Link DNS-340L version 1.04.B02 D-Link DNS-340L version 1.05b04 D-Link DNS-345 version 1.01B04 D-Link DNS-345 version 1.03B06 D-Link DNS-345 version 1.04.B02 D-Link DNS-345 versi...

CVE-2026-82879: Incorrect Authorization

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...

PT-2026-83783

DataEase before 2.10.26 contains multiple access control defects in the sharing link module. Tickets are not bound to the target share UUID, so a valid ticket issued for one share can be reused against another ShareTicketManage.validateTicket / POST /de2api/share/proxyInfo. The POST...

PT-2026-83800

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsi mgr.cgi. Performing a manipulation of the argument alias/username/password/volume location results in os command injection. It is possible to initiate the attack...

PT-2026-84041

Name of the Vulnerable Software and Affected Versions Sulu versions prior to 2.6.25 Sulu versions prior to 3.0.8 Description An issue exists in the preview-link endpoint and the src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php file where VIEW permissions are not enforced f...

PT-2026-83790

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/ve mgr.cgi. This manipulation of the argument f dev causes os command injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-82690: Improper Neutralization of Special Elements used in an OS Command

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/vemgr.cgi. This manipulation of the argument fdev causes os command injection. The attack is possible to be carried out remotely. The exploit has...

wave5_vpu_remove Heap Buffer Overflow DoS

The vulnerability of the wave5vpuremove function in the drivers/media/platform/chips-media/wave5/wave5-vpu.c driver for multimedia devices in the Linux kernel is related to errors during the update of the link counters. Exploiting this vulnerability can allow an attacker to cause service failures...

Linux kernel BH1780 Buffer Overflow DoS

The vulnerability of the bh1780readraw function in the iio/light/bh1780.c driver module of Linux’s sensor drivers is related to errors during link counters updates. Exploiting this vulnerability could allow an attacker to cause service failures remotely...

Linux USB Device Driver Heap Buffer Overflow DoS

The vulnerability of the gethallocinst function in the drivers/usb/gadget/function/fsubset.c file of the Linux USB device driver module is related to errors during link counters updates. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

CVE-2026-82691: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usbdevice.cgi of the component CGI Handler. Such manipulation of the argument fupsip leads to os command injection. The attac...

CVE-2026-82595 D-Link DIR-825M System Command Execution formSysCmd sub_456CF4 command injection

A vulnerability was found in D-Link DIR-825M 1.1.8. Affected by this vulnerability is the function sub456CF4 of the file /boafrm/formSysCmd of the component System Command Execution. Performing a manipulation of the argument sysCmd results in command injection. It is possible to initiate the atta...