134326 matches found
netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation
A flaw was found in netty-handler, a component of the Netty network application framework. A remote attacker can exploit an incorrect masking operation in the IpSubnetFilterRule.compareTo function to bypass configured IPv6 subnet rules. This allows valid public IP addresses to circumvent intended...
CVE-2026-18600
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switchinfo/network.switchstatus of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack ma...
CVE-2026-18600
A vulnerability has been found in GL.iNet GL-MT3000 up to 4.4.5. This affects the function network.switchinfo/network.switchstatus of the file /usr/lib/oui-httpd/rpc/network of the component Network Lua RPC Plugin. Such manipulation of the argument switch leads to command injection. The attack ma...
CVE-2026-68742
A flaw was found in SSSD. The sssnssprotocolparseaddr function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and...
CVE-2026-62416
Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and uploa...
EUVD-2026-52254
CTI-Transmute is affected by a server-side request forgery vulnerability in the evaluation report PDF-generation functionality. User-controlled CTI content, including conversion names, descriptions, and comments, is converted from Markdown to HTML and rendered as a PDF using WeasyPrint. Before th...
CVE-2026-62416
Network Scanner Tool and Network Scanner Tool Lite provided by Sharp Corporation, with the initial configuration, require no authentication and accept files unlimitedly. When the affected products are used with the initial configuration, anyone can connect to them without authentication and uploa...
CVE-2026-62416
The CVE-2026-62416 entry concerns Sharp Corporation’s Network Scanner Tool and Network Scanner Tool Lite configured with no authentication, allowing unlimited file uploads over the network. The underlying issue enables an unauthenticated attacker to connect and upload files, potentially causing d...
crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
A flaw was found in the crypto/tls package within the Go golang standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock,...
CVE-2026-18589
The CVE-2026-18589 entry concerns Wavlink WL-NU516U1 (model 708c073-mt7628). The vulnerability is in nas.cgi, affecting the change_password function where manipulating User1Passwd triggers a stack-based buffer overflow. It is a NETWORK-accessible flaw with LOW attack complexity and NO user intera...
CVE-2026-18584
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...
CVE-2026-18584
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...
CVE-2026-18584
GL.iNet: Affects E5800/E750/X2000/X3000/XE3000/XE300 devices; eSIM LPA API v1, file /sdk/v1, improper authorization due to manipulation of a function. Attack possible only from local network; vendor confirmation exists. No patch/workaround details provided in the documents.
EUVD-2026-52153
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...
CVE-2026-18584 GL.iNet E5800/E750/X2000/X3000/XE3000/XE300 eSIM LPA API v1 improper authorization
A security vulnerability has been detected in GL.iNet E5800, E750, X2000, X3000, XE3000 and XE300 up to 20260707. Impacted is an unknown function of the file /sdk/v1 of the component eSIM LPA API. Such manipulation leads to improper authorization. The attack can only be initiated within the local...
CVE-2026-20482
In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote proximal/adjacent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00486814; Issue ID: MSV-6824...
CVE-2026-20465
In wlan AP driver, there is a possible out of bounds write due to a missing bounds check. This could lead to remote proximal/adjacent escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00489200; Issue ID: MSV-783...
frr: FRRouting: Denial of Service via crafted BGP UPDATE message
A flaw was found in FRRouting FRR. Missing input validation in the rfapiRibBi2Ri function allows a remote attacker to cause a Denial of Service DoS by sending a specially crafted BGP Border Gateway Protocol UPDATE message. This vulnerability can disrupt network services managed by FRR...
EUVD-2026-52072
In wlan STA FW, there is a possible system becoming unresponsive due to logging. This could lead to remote proximal/adjacent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: WCNCR00486814; Issue ID: MSV-6824...
