CVE-2026-9294

Summary: CVE-2026-9294 affects Edimax BR-6428NS (firmware 1.10). The vulnerability is in the POST Request Handler, inside the function formWanTcpipSetup, where manipulation of the argument pppUserName leads to a buffer overflow. This could be triggered remotely, and an exploit is publicly availab...

CVE-2026-9294 Edimax BR-6428NS POST Request formWanTcpipSetup buffer overflow

A vulnerability was identified in Edimax BR-6428NS 1.10. The impacted element is the function formWanTcpipSetup of the file /goform/formWanTcpipSetup of the component POST Request Handler. Such manipulation of the argument pppUserName leads to buffer overflow. It is possible to launch the attack...

CVE-2026-6898

creationtimestamp| type| source ---|---|--- 2026-05-23 06:51:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmiudlcyml2k 2026-06-06 11:02:52+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mnmivyrxak2z...

CVE-2026-42674

creationtimestamp| type| source ---|---|--- 2026-05-23 05:32:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mmipvoyrcm2s...

Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron

Summary nezha's dashboard supports two user roles: RoleAdmin Role==0 and RoleMember Role==1. The cron routes POST /api/v1/cron and PATCH /api/v1/cron/:id are wired through commonHandler any authenticated user rather than adminHandler, and the per-server permission check on cron creation has a...

Edimax BR-6428nS 命令注入漏洞

The Edimax BR-6428nS is a wireless router produced by Edimax Corporation. Version 1.10 of the Edimax BR-6428nS has a command injection vulnerability. This vulnerability stems from improper handling of multiple parameters in the system function of the goform/formWlanM file during POST request...

UserSpice 安全漏洞

UserSpice is an open-source PHP framework for user management and identity authentication. Version 4.3.24 of UserSpice contains a security vulnerability that stems from username enumeration. This vulnerability could allow unauthenticated attackers to discover valid usernames by sending POST...

Edimax BR-6428nS 安全漏洞

The Edimax BR-6428nS is a wireless router produced by Edimax Corporation. Version 1.10 of the Edimax BR-6428nS contains a security vulnerability. This vulnerability stems from improper handling of the parameter “pppUserName” in the POST request processing program, specifically in the...

D-Link DIR-601 安全漏洞

The D-Link DIR-601 is a home wireless router produced by D-Link Corporation. The D-Link DIR-601 2.02NA version has a security vulnerability. This vulnerability arises from manipulating the tablename parameter in POST requests, which may allow unauthenticated attackers to retrieve sensitive...

Edimax BR-6428nS 命令注入漏洞

The Edimax BR-6428nS is a wireless router produced by Edimax Corporation. Version 1.10 of the Edimax BR-6428nS contains a command injection vulnerability. This vulnerability stems from improper handling of the parameter “repeaterSSID” in the formWlbasic function within the POST request processing...

PT-2026-42870

Name of the Vulnerable Software and Affected Versions Edimax BR-6428NS version 1.10 Description A buffer overflow can be triggered remotely via the POST Request Handler component. The issue exists within the formWirelessTbl function located in the '/goform/formWirelessTbl' endpoint when the vapur...

CVE-2026-6406

creationtimestamp| type| source ---|---|--- 2026-05-22 23:12:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmi2oefbjz2r 2026-05-29 20:37:06+00:00| seen| https://bsky.app/profile/cyberhub.blog/post/3mmzfbhtkvr2x...

CVE-2026-48700

creationtimestamp| type| source ---|---|--- 2026-05-22 23:07:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmi2fe6z5d2h 2026-05-24 21:10:32+00:00| seen| https://bsky.app/profile/matoken.inari.opencocon.org.ap.brid.gy/post/3mmmusivcvso2...

CVE-2026-39969

creationtimestamp| type| source ---|---|--- 2026-05-22 22:51:57+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhzk5mgio2q...

CVE-2026-9291

creationtimestamp| type| source ---|---|--- 2026-05-22 22:46:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhzb23z742o...

CVE-2026-39968

creationtimestamp| type| source ---|---|--- 2026-05-22 22:38:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhysg2wbj2n...

CVE-2026-39970

creationtimestamp| type| source ---|---|--- 2026-05-22 22:32:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhygjnno62o 2026-05-23 20:27:45+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116625766625880175 2026-06-06 11:02:43+00:00| seen|...

CVE-2026-40597

creationtimestamp| type| source ---|---|--- 2026-05-22 22:24:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhxykfjqe2i 2026-06-06 11:02:53+00:00| seen| https://bsky.app/profile/keiwork35.bsky.social/post/3mnmiw2dm4a2l...

CVE-2026-40598

creationtimestamp| type| source ---|---|--- 2026-05-22 22:19:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmhxqruzhh2h...

CVE-2026-40864 JupyterHub: Cross-origin form POSTs bypass XSRF

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection updated in 4.1.0 inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. The JSON API is not affecte...